feat(idp): add keycloak-first support with authentik fallback

scripts/migrate_idp_user_id_to_text.sql

@@ -0,0 +1,6 @@
+ALTER TABLE users
+  ALTER COLUMN idp_user_id TYPE VARCHAR(128)
+  USING CASE
+    WHEN idp_user_id IS NULL THEN NULL
+    ELSE idp_user_id::text
+  END;