Map OIDC accounts to Nachet users

Relates to #818

## Context

Nachet currently uses the identity provider’s user ID directly as `User.oid` and expects it to be a UUID. This works for Entra and Keycloak, but other OIDC providers use different formats. Google uses an opaque string, while Auth0 IDs can look like `auth0|abc123`.

An OIDC subject is also only unique within its issuer, so `iss` and `sub` need to be considered together.

## Goal

Map each external OIDC identity to an internal Nachet user ID:

```text
issuer + subject -> Nachet user ID
```

This lets Nachet keep using internal UUIDs without requiring every provider to issue one.

## Acceptance Criteria

- [ ] Support UUID and non-UUID subjects.
- [ ] Keep identities from different issuers separate.
- [ ] Preserve existing Entra users and their data.
- [ ] Create the mapping during user registration.
- [ ] Reject missing or conflicting mappings.
- [ ] Do not use email as the identity key.
- [ ] Add migration and mapping tests.

We should also decide whether one Nachet user can link more than one provider account.

Start by tracing user registration and the existing User.oid handling, then inspect the migration and mapping tests mentioned in the issue. The work is done when UUID and non-UUID subjects are mapped by issuer and subject, existing Entra data is preserved, conflicts are rejected, email is not used as the key, and the migration and mapping tests pass.

索引モデルが issue の本文から書いたものです。