SSO: Backfill verified_at when associating an existing account

When an existing non-SSO account is associated with an SSO login via
`SSO_SIGNUPS_MATCH_EMAIL`, the user's `verified_at` is never set, even
though the provider vouches for the address on every SSO login. Such
users keep seeing the "verify your email" nudge unless they go through
the manual email verification flow.

Now `verified_at` is set on SSO login when the provider email matches
the locally stored one, mirroring the existing behavior for new SSO
users which get `verified_at` set on signup under the same conditions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/api/identity.rs

@@ -336,6 +336,13 @@ async fn sso_login(
                     user.name = user_name.clone();
                 }
 
+                user.save(conn).await?;
+            } else if user.verified_at.is_none()
+                && user.email == user_infos.email
+                && user_infos.email_verified.unwrap_or(CONFIG.sso_allow_unknown_email_verification())
+            {
+                // The email verification is handled by the provider, backfill for accounts created before SSO
+                user.verified_at = Some(now);
                 user.save(conn).await?;
             }