Bind sign-in identity to the Google sub, not the claim email

findAppUserByAuthEmail keys the allowlist on the email Google returns in the OIDC claim. coder-mars-cc and -ca both reported (2026-10-08) that mars deliberately binds identity to the Google sub plus the Supabase auth id instead, because the claim email is not a stable identity proof; neither had primary evidence on whether Google's claim email varies across sign-ins. Current code compensates by comparing a gmail-dotless, googlemail-folded key on both sides, which is enough for a 2-row allowlist but is still email-keyed. Consider storing the Google sub on app_users at first sign-in and matching on it, keeping email only as the bootstrap lookup.