Codex review round 8 on 679b45e5f:
- matchesReplacementCredential: an org-scoped incoming credential now
matches an existing row keyed by ANY of its base identities
(email/account/project), bare or org-qualified with the same org, plus
the bare org-only key — so an account-keyed row stored while email
recovery failed is claimed once a later same-subscription login
recovers the email, instead of duplicating. Org-less incoming
credentials keep exact-key matching only.
- auth-broker migrate: index org-only broker snapshot rows by their org
id so reruns skip an already-migrated row instead of re-uploading a
stale refresh token over the broker's newer one.
chan1103