🪪 feat: store each user's identity provider subject as oidc_sub

[erick-GeGe]

Targets main. #306 is stacked on top of it.
Nothing reads the new column yet: sign-in is unchanged.

Why

Whatever single sign-on estela ends up with, every product needs one identifier that means the same person everywhere. Billing sums usage by it, and each product finds its own row for a person by it. That identifier is the identity provider's sub: stable, unique, never reused.

Email looks like the obvious key and is the wrong one. People change theirs, and an address freed by a deleted account can be registered by someone else, who would then inherit the old owner's projects.

What

UserProfile.oidc_sub, nullable and unique. Migration 0044_userprofile_oidc_sub.

• Nullable: an account that has not been linked has no subject, and making one up would be a lie.
• Unique: two accounts can never claim the same person.

Existing accounts are linked by setting their oidc_sub ahead of time. The optional OpenID Connect sign-in (a follow-up PR) finds accounts by it, and creates new ones with it.

Notes

• Staging: its django_migrations still lists 0044_apikey_expires_at, recorded before the API key migrations were merged into one. Harmless: Django ignores recorded migrations that no longer exist. This migration has a different name, so it applies normally, and the expires_at column is already there.
• Already on 🔑 feat: let estela-cli send people here to create its key #304: makemigrations --check reports index renames on MeteredUsageRecord. They are not touched here.