login-email-drift-blocked: consider auto-sync email when supabaseAuthId sub already matches

auth/callback refuses silent email overwrite on a supabaseAuthId (sub) match when stored email != Google-reported email, alerting + redirecting login?error=email-conflict (first occurrence 2026-08-02, user Cami Baroni, camibaroni99@gmail.com -> cami.baroni@hotmail.com, resolved as one-off DB fix by db-mars-cc). Since identity is already verified via sub not email, auto-sync may be safe and would prevent recurrence for any student whose Google account email changes. Design review: should callback/route.ts auto-update users.email on a verified sub-match instead of blocking, or is manual review intentional? Not urgent, single confirmed-benign instance so far.