pixel prefix handling

> The authentication middleware now handles temporary user merging, which could be a slow operation involving multiple database queries and group updates. This blocking operation happens on every authenticated request for new users. Consider offloading this to a background job or showing a loading state to the user, as this could cause request timeouts for users with many project invitations.
> ```suggestion
> // Offload the merge and save to a background job to avoid blocking the request
> user.data.mergePending = true;
> req.user = user;
> // Start the merge in the background
> setImmediate(async () => {
> try {
> await user.mergeFromTemporaryUser(existingUser);
> await user.save();
> // Optionally, clear the mergePending flag here if you want to update the user record
> } catch (err) {
> console.error("Background mergeFromTemporaryUser failed:", err);
> }
> });
> next();
> ```

_Originally posted by @Copilot in [#431](https://github.com/CenterForDigitalHumanities/TPEN-services/pull/431/changes#r2608032786)_

Start in the authentication middleware where temporary-user merging runs for new authenticated users, and inspect mergeFromTemporaryUser and the subsequent save. Determine how the merge can avoid blocking requests while preserving group updates and handling failures; done means the request no longer risks timing out during this operation.

Written by the indexing model from the issue text.