Document as durable person key (DNI/legajo/passport/CUIT); email+googleSub are rotatable credentials; build email-change re-link flow

Elazar insight (2026-07-20): email is NOT a stable student identifier - students abandon a full mailbox and make peter2@gmail.com, then ask to update their email. And a new Gmail = a new Google account, so googleSub rotates too. Both email AND googleSub are rotatable LOGIN CREDENTIALS, not the person. The only stable person key is the institutional/government document: DNI / legajo / passport / CUIT. Implication for EVO-79: exact-email stays a fast-path auto-link for the unchanged case; when email/Google-account changes, login finds no email match => resolve on the DOCUMENT => suggested-user confirm => update email + re-bind new sub to the SAME account, never a duplicate (document routes to confirm, never auto-link - a DNI can be mistyped/shared). GAP: the document is not reliably on user accounts today - venus users has NONE (only via alumnos join), mars/pluto partial. SCOPE (awaiting Elazar GO): make the document the required durable person key on user accounts fleet-wide + build the email-change re-link flow + pull exact per-app document coverage. STATUS: proposed to Elazar, awaiting his go before scoping/dispatch.