refactor(db): migrate Identity schema

Complete schema ownership by moving all ASP.NET Identity tables to an additive provider-aware migration. Preserve credentials, security state, preferences, roles, claims, external logins, tokens, indexes, and cascades.

docs/verification/jt-019-schema-ownership.md

@@ -44,6 +44,8 @@ cohesive table groups. It does not attempt to delete the legacy reconciler whole
 - Added `20260830133000_AdoptCareerProfileSchema` for the canonical profile, append-only history,
   and all six ordered relational child types. Legacy JSON, Norwegian text, stable keys, and cascade
   ownership are retained.
+- Added `20260830134000_AdoptIdentitySchema` for the complete ASP.NET Identity aggregate, preserving
+  accounts, password hashes, 2FA state, preferences, roles, claims, external logins, and tokens.
 - Corrected the ownership runbook: new tables now default to migrations; the reconciler is legacy
   compatibility code to retire one dependency group at a time.
 
@@ -87,14 +89,21 @@ migration.
 - A populated Career Profile with history, long-tail JSON, Norwegian text, experience, education,
   skills, projects, certifications, and languages survives adoption, downgrade, and re-upgrade; all
   14 aggregate indexes and parent cascades remain effective.
+- A populated Identity account with password hash, Bokmål preference, 2FA state, role assignment,
+  role/user claims, external login, and token survives adoption, downgrade, and re-upgrade; all eight
+  Identity indexes and user/role cascades remain effective.
 - Generated MariaDB SQL contains the provider-correct `SystemEmailSettings` DDL.
-- Full backend: 735/735 passed after the Career Profile aggregate transfer.
+- Full backend: 736/736 passed after the Identity aggregate transfer.
+- Fresh application startup over a new disposable SQLite data root applied the complete chain,
+  queried/seeded Identity roles, and reached the healthy listening state with no schema failure.
 - Fresh application startup over a new disposable SQLite database applied
   `20260830120000_AdoptSystemEmailSettingsSchema` and reached the healthy listening state.
 
 ## Remaining JT-019 work
 
-Seven model tables remain startup-created: the ASP.NET Identity group.
+No EF model tables remain startup-created. JT-019's creation-ownership transfer is complete; the
+startup reconciler now performs compatibility repair only and can be reduced further when historical
+provider fixtures prove individual repairs obsolete.
 with parent dependencies. Transfer them in small dependency-aware migrations with blank, populated,
 retry and MariaDB runtime proof. Column/index repairs must remain until historical upgrade fixtures
 prove each one redundant.