Expose verified account identity in sessions
Signed-in session responses do not distinguish GitHub OAuth accounts from self-declared handles. This adds identityVerified to /api/session, derived from the stored users.github_id > 0, and documents the caller invariant that makes this distinction valid. Token admission and recording eligibility remain unchanged.
Two regression tests cover self-declared sign-in and OAuth sign-in without email. Both failed on the missing field before the implementation and passed afterward. The OAuth test uses a stub whose email endpoint would return 403; recording is disabled, so that endpoint is not requested.
Validation: the two targeted tests passed, and ./scripts/test.sh exited with code 0. The gate reported skipped browser checks due to unavailable Chromium, Java, or browser/server prerequisites, and skipped cargo-audit, actionlint, ruff, and shellcheck.
This implements P1 of #306.
Refs #306
Closes #315
Summary by cubic
Signed-in session responses now include identityVerified, letting clients distinguish GitHub OAuth accounts from self-declared handles. The flag is derived from users.github_id > 0, relying on the existing caller invariant that only the OAuth callback stores positive IDs. Token admission and recording eligibility are unchanged.
Regression tests cover self-declared sign-in, OAuth sign-in without email, the zero GitHub ID boundary that guards against an accidental > to >= change, and identity isolation when a typed handle matches an existing OAuth account's login. This implements P1 of #306 and closes #315.