Integration test: prove a verified login adopts an existing account and inherits its role

## Summary

Add integration coverage that a verified login actually adopts an existing account and inherits its role.

The account-adoption gate has unit coverage and an integration test for the **denial** path (an unverified-claim collision is denied) and the roleless-login path. There is no end-to-end proof of the **positive** path: a regression that denied every login would still pass the current integration suite.

## Scope

- Boot real Harper with a stub OIDC provider that issues a JWKS-signed id token with a validated issuer and `email_verified: true`; seed an `hdb_user` whose name equals that verified email; assert the login adopts the account and inherits its role.
- Add escape-hatch coverage: with `allowUnverifiedClaimInheritance` enabled, an unverified claim adopts the account (the config-layer opt-out works end to end).

A JWKS-signing stub-IdP fixture is the main piece of work.

Start by locating the existing integration coverage for the denial and roleless-login paths, then trace how real Harper is booted with the stub OIDC provider. Add a JWKS-signed stub-IdP fixture and cover verified adoption plus the allowUnverifiedClaimInheritance escape hatch; done means both positive end-to-end cases adopt the seeded hdb_user and inherit its role.

Written by the indexing model from the issue text.