feat(token): support link_identity in the token-exchange grant

[spydon]

What

Adds link_identity support to the token-exchange grant (#2609), so an already-authenticated user can attach a provider identity using a provider access token.

POST /token?grant_type=urn:ietf:params:oauth:grant-type:token-exchange
Authorization: Bearer <current user session>
{
  "provider": "facebook",
  "subject_token": "<facebook access token>",
  "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
  "link_identity": true
}

Why

Parity with the id_token grant, which already supports link_identity. Lets a user who signed in another way connect their Facebook account natively (no browser). Because it only needs the verified provider subject, it works even when the app is already authorized (the token is a classic access token with no id token), which is the common case.

How

• When link_identity is set, require a valid user access token in the Authorization header (requireAuthentication), resolve the target user, and reject the request if that user is banned (requireAuthentication itself does not check bans).
• After verifying the provider token, branch to linkIdentityToUser (using the verified subject) instead of the sign-in-existing lookup. No profile claims are needed, only the subject from debug_token.

Limitations

• Email-less target users (anonymous / phone-only with no email) cannot complete a link here: linkIdentityToUser requires an email to confirm and the Facebook access token carries none. Those users should link via the existing web flow (LinkIdentity, which fetches the profile via /me).
• The linked identity's identity_data is sparse (only the subject), unlike the web flow which stores the full profile (email/name/avatar).

Tests

• TestTokenExchangeLinkIdentity: links Facebook to an existing signed-in user; asserts the same user is returned and the facebook identity is attached.
• TestTokenExchangeLinkIdentityRequiresAuth: linking without an Authorization header is rejected.
• TestTokenExchangeLinkIdentityRejectsBannedUser: a banned user cannot link (and thus cannot re-establish a session).

Stacking

Stacked on #2609 (base branch feat/facebook-access-token-grant). Review/merge that first; this diff is only the linking addition.

[spydon]

Closing this since it wouldn't work for users that aren't logged in.