feat(idp): add keycloak-first support with authentik fallback

scripts/init_schema.sql

@@ -20,7 +20,7 @@ DROP TABLE IF EXISTS permissions CASCADE;
 CREATE TABLE users (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   user_sub TEXT NOT NULL UNIQUE,
-  idp_user_id INTEGER,
+  idp_user_id VARCHAR(128),
   username TEXT UNIQUE,
   email TEXT UNIQUE,
   display_name TEXT,

scripts/migrate_add_authentik_user_id.sql

@@ -1,2 +1,2 @@
 ALTER TABLE users
-  ADD COLUMN IF NOT EXISTS idp_user_id INTEGER;
+  ADD COLUMN IF NOT EXISTS idp_user_id VARCHAR(128);

scripts/migrate_idp_user_id_to_text.sql

@@ -0,0 +1,6 @@
+ALTER TABLE users
+  ALTER COLUMN idp_user_id TYPE VARCHAR(128)
+  USING CASE
+    WHEN idp_user_id IS NULL THEN NULL
+    ELSE idp_user_id::text
+  END;