- resolveEmployeeForEmail + /auth/staff now resolve the Employee through the
unified identity's aliases: louis@targo.ca finds HR-EMP-4 (under
louispaul@targointernet.com). Fixes "no employee linked" for Louis-Paul.
- /auth/staff collapses multiple Authentik accounts with the same email into one
row (username `joseph` + `joseph@...` → one), flags dup_accounts for cleanup.
- provision LINKS an existing Employee (match user_id → company_email → name)
instead of creating a duplicate — fixes the Aurélie HR-EMP-107 doublon risk.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
148cb9a320