AXI-180: Add full local and hybrid identity management

[Codename-11]

Summary

• Add local-only, external-only, and hybrid authentication policy with safe provider selection, auto-redirect, and protected break-glass access.
• Add durable local users, scrypt passwords, setup/reset and invitation registration, linked external login methods, immediate session revocation, user lifecycle administration, and global profile pictures.
• Keep login identities separate from operational Integration Connections, close guest project-mutation gaps, and preserve complete project/integration grants as AXI-181.

Verification

• pnpm ci:local:quality - 1,577 passed, 1 intentional skip
• Full Playwright - 59 passed, 1 scenario-only skip
• Rebuilt identity Playwright - 4/4 passed
• pnpm lint - passed with existing repository warnings
• pnpm typecheck - passed
• Production Next.js build - compiled successfully with 49 routes
• Additive Prisma migration - applied successfully to the disposable local database

Notes

• Existing deployments retain hybrid sign-in and environment-backed break glass during migration.
• This PR does not release or deploy Forge.
• Follow-up AXI-181 owns restricted-project visibility and explicit integration grants so those authorization changes can be reviewed independently.