feat(auth): Microsoft OAuth sign-in/link + self-serve signup via Google/Microsoft

Wave 7. Mirrors the existing Google ID-token-exchange pattern (Program.cs
smart-scheme dispatch, JWT bearer scheme, AuthController exchange/link/
unlink endpoints, ApplicationUser fields, reconciler columns) for
Microsoft Entra ID + personal accounts via the multi-tenant "common"
endpoint.

Google/Microsoft sign-in previously only worked for accounts already
linked to an existing local user -- there was no way to actually sign
up via OAuth. Both exchange endpoints now create a new user when no
match is found and Auth:AllowRegistration is true, same gate as
email/password registration.

Frontend: new MicrosoftAuthCard (MSAL popup flow -- Microsoft has no
vanilla-JS equivalent to Google's Identity Services script) wired into
the login page's provider tabs and the profile page's account-linking
section. REACT_APP_MICROSOFT_CLIENT_ID env var, Auth:MicrosoftClientId
config gate on the backend.

Models/ApplicationUser.cs

@@ -16,4 +16,7 @@ public sealed class ApplicationUser : IdentityUser
     public string? GoogleSubject { get; set; }
     public string? GoogleEmail { get; set; }
     public DateTimeOffset? GoogleLinkedAt { get; set; }
+    public string? MicrosoftSubject { get; set; }
+    public string? MicrosoftEmail { get; set; }
+    public DateTimeOffset? MicrosoftLinkedAt { get; set; }
 }