Persist and backfill portal bug reporter identities

Add portal-owned persistence for bug reporter identity and an offline, safe backfill path using a minimal Keycloak group-member export. Do not build the staff admin UI yet. Scope: - Store only identities associated with portal bug reports, keyed by the existing opaque account key. - Capture identity for future authenticated submissions. - Import existing identities from a local Keycloak group-members JSON export using the verified ProjectRubika issuer. - Keep identity out of Forgejo payloads, reporting worker contracts, logs, and the standalone workflow coordinator. Acceptance criteria: - Schema migration and EF model support reporter name, username, email, source, and capture/update timestamps. - Backfill defaults to dry-run, requires explicit apply, is idempotent, validates duplicate/malformed users, and summarizes matches without printing PII. - Legacy/unmatched reports remain untouched and are counted. - Future report submission updates reporter identity in the same database transaction. - Focused unit/SQL tests pass; no admin page is included. Implemented outcome: - Added portal migration 010 and a portal-only reporter directory keyed by the existing account hash. - Future submissions capture or refresh OIDC name, preferred username and email in the report transaction. - Added an explicit-issuer, aggregate-only backfill command. Dry-run is the default; apply is insert-only, account-locked, idempotent, and refuses unresolved non-legacy reporter accounts. - The provided ignored Keycloak group export contains 12 valid, unique user IDs and produces 12 unique account hashes for the verified ProjectRubika issuer. - Forgejo payloads, worker contracts and the standalone coordinator are unchanged. - Validation passed: portal build, 23 focused bug-reporting tests, and 13 real-SQL schema tests. - Pull request: #2782 https://git.project-rk.com/prk/engines/pulls/2782 - Production portal deployed migration 010. A one-time insert-only manual backfill stored all eight Keycloak-group reporter identities (seven inserted, one already captured), covering 42 reports. Seventeen legacy accounts and one accepted unidentified General reporter remain without identity. Temporary export and SQL files were removed.