SECURITY: Users on shared computers may authenticate as wrong user

## Summary

Critical authentication vulnerability where users on shared computers can inadvertently be authenticated as a different user, accessing another user's data.

## Reproduction Steps

1. User A logs into MJExplorer via MSAL, works normally
2. User A terminates MJAPI and MJExplorer **without logging out**
3. User B starts MJAPI and MJExplorer on the same machine
4. User B sees User A is still logged in (expected - MSAL localStorage cache)
5. User B signs out and logs in with their own credentials (different domain)
6. **User B sees User A's data** instead of their own
7. MSAL logout page correctly shows User B's account
8. Clearing cookies and switching browsers does NOT fix the issue

## Impact

- **Severity**: Critical
- **Type**: Authentication bypass / session confusion
- Users can access another user's data without authorization
- Affects shared computer/development environments

## Technical Analysis

### Key Finding
Switching browsers doesn't fix the issue, confirming this is a **server-side problem**, not client-side MSAL caching.

### Investigated Components

1. **UserCache Singleton** (`packages/SQLServerDataProvider/src/UserCache.ts`)
- Uses `MJGlobal.Instance.GetGlobalObjectStore()` which could persist across restarts
- User lookup is by email via `UserCache.Instance.Users.find()`

2. **User Verification** (`packages/MJServer/src/auth/index.ts:187-267`)
- `verifyUserRecord()` searches cache by email
- Should be correct but needs logging to verify

3. **Context Creation** (`packages/MJServer/src/context.ts`)
- Token verification looks correct
- `userEmailMap` could remap emails if configured

4. **MSAL Provider** (`packages/Angular/Explorer/auth-services/`)
- Uses localStorage for account caching
- Logout should clear cache properly

### Potential Root Causes (Ranked)

1. **Database Issue**: User B's email mapped to User A's user record
2. **userEmailMap Configuration**: Environment variable remapping emails
3. **UserCache Persistence**: Global object store not clearing on restart
4. **Process not fully terminating**: Hot reload keeping state

## Diagnostic Steps Needed

1. Check database:
```sql
SELECT ID, Email, FirstName, LastName, IsActive
FROM __mj.vwUsers
WHERE Email LIKE '%domain1%' OR Email LIKE '%domain2%'
```

2. Add logging to `context.ts:172-173`:
```typescript
console.log('JWT email extracted:', userInfo.email);
```

3. Add logging to `auth/index.ts:197-204`:
```typescript
console.log('Looking for email:', email);
console.log('Found user:', user?.Email, user?.ID);
```

4. Check for `USER_EMAIL_MAP` in environment variables

## Files to Review

- `packages/SQLServerDataProvider/src/UserCache.ts`
- `packages/MJServer/src/auth/index.ts`
- `packages/MJServer/src/context.ts`
- `packages/MJServer/src/resolvers/UserResolver.ts`
- `packages/Angular/Explorer/auth-services/src/lib/providers/mjexplorer-msal-provider.service.ts`

## Labels

security, bug, critical, authentication