feat: one account can bind both netease + skin identities

- db: user_identities table (UNIQUE user_id+source), migrate backfill from users
- auth: GET/POST/DELETE /api/auth/identities - bind/unbind/list identities
  (netease requires UID, one per source, name uniqueness, keep >=1)
- register/external/plugin/admin-created users auto-write primary identity
- tickets: submit uses selected identity (validated belongs to user)
- dashboard: 我的身份 card with bind/unbind UI
- ticket-create: identity selector when >1 identity

public/js/api.js

@@ -25,6 +25,7 @@ const API = {
   get(p) { return this.req('GET', p); },
   post(p, d) { return this.req('POST', p, d); },
   put(p, d) { return this.req('PUT', p, d); },
+  delete(p) { return this.req('DELETE', p); },
 
   async download(path) {
     const token = Auth.token();