#8039 feat: record a choice for gateway members added after sign-in

AIM-596 (4 of 5)

Stacked on #8038.

Summary

• Where upstream_auth_enforced is on, a gateway member with no choice for the presented user session is checked the first time it's served. If it joined after the credential was first issued, it gets a choice recorded once (RecordNewMemberSelection, ON CONFLICT DO NOTHING, source new_member) when nothing is left to pick:
  • no upstream authentication when the server declares none (or is undecided with nothing offered), or
  • its single permitted client that is ready with no action: a shared or pass-through client, or a personal client whose connection is already live (AuthClientNeedsReconnect).
• Several ready clients, a client needing a connection, or an identity-provider client leave the member unavailable with the existing "needs setup or a new sign-in" message, so the person reconnects to choose. A denied client never counts.
• "Joined after issuance" compares the member link's created_at (or, on the organization gateway, the server's) with the credential lineage's first user_sessions row. A member present at issuance was considered then, so an unavailable or unselected one is never treated as new.
• Choices are re-read after recording, so a concurrent request that recorded first is used as is. Recorded choices are never replaced.
• Only user-session credentials. Execution profiles keep their own versioning (AIM-598).

Motivation

RFC section 7.10: adding a gateway member must not force everyone to reconnect when there's nothing to choose. It also must not silently pick between identities, expand access, or reinterpret a member someone already saw and skipped.