oauth-identity-capture

apron-auth's `IdentityProfile` exposes `tenancies: tuple[TenancyContext, ...]` rather than per-provider claim fields. Each `TenancyContext` carries `id`, `name`, `domain`, `raw`, and a normalized `own...