feat(idp): add keycloak-first support with authentik fallback

docs/INTERNAL_API_HANDOFF.md

@@ -141,7 +141,7 @@ Response:
 {
   "id": "uuid",
   "user_sub": "authentik-uid",
-  "idp_user_id": 123,
+  "idp_user_id": "idp-user-id-or-uuid",
   "username": "chris",
   "email": "chris@ose.tw",
   "display_name": "Chris",
@@ -166,7 +166,8 @@ Response:
 }
 ```
 
-### POST `/internal/authentik/users/ensure`
+### POST `/internal/idp/users/ensure`
+（相容路徑：`/internal/authentik/users/ensure`）
 Request:
 ```json
 {
@@ -181,7 +182,7 @@ Request:
 Response:
 ```json
 {
-  "idp_user_id": 123,
+  "idp_user_id": "idp-user-id-or-uuid",
   "action": "created"
 }
 ```