OIDC: require explicit confirmation when linking local accounts

With GOTIFY_OIDC_LINK_BY_USERNAME=true, the first OIDC login whose username claim matches an existing local user binds that OIDC identity to the user.

The account owner is never asked to confirm the linking. This is okay when the admin controls both the identity provider and gotify (the use case the setting is meant for), but a misconfiguration or an untrusted username mapping in the IdP allows taking over a local account without the owner's involvement.

Possible solutions:
- Allow linking the OIDC identity only when an existing session of the local user exists. Maybe a button in a settings page (link with OIDC).
- Prompt for password of the user account before linking the OIDC identity to the local user.

Originally privately reported by @lenny-ts

Start by tracing the OIDC login flow that handles GOTIFY_OIDC_LINK_BY_USERNAME=true and the existing local-account authentication flow. Compare the proposed existing-session and password-confirmation approaches, then define how an account owner explicitly approves linking and how the takeover scenario is prevented. The issue names no files or tests, so locate the relevant entry points before implementation.

Written by the indexing model from the issue text.