auth/callback 42P08: raw bind-placeholder in accessRequestMatchExpr blocks real logins

Postgres 42P08 'could not determine data type of parameter $1' firing in prod on /auth/callback since 2026-07-28, uncaught (500, no friendly redirect, no appEvents log). Root cause: accessRequestMatchExpr() in access-request-resolver.ts builds ($1 IS NOT NULL AND canonicalizeEmail(u.email)=canonicalizeEmail($1)) with a raw placeholder and no cast -- Postgres can't infer $1's type from IS NOT NULL alone. 2 call sites affected: auth-autolink.ts:75 evaluateExactEmailLinkability (confirmed firing, every first-time-login auto-link hits it, 2 real users blocked 07-28/29) and access-request-resolver.ts:143 resolveAccessRequestCandidates (same defect, not yet observed firing, reachable from public /solicitar-acceso submit). Fix verified live via psql PREPARE: cast placeholder tokens to ::text at both sites. Class-A (auth path). Coder implementing + regression test + audit pre-push review before push (audit-pluto-ca confirmed live in roster).