A declared identity key matches a fresh sign-in to its existing connection

[czpython]

Since #302, a fresh sign-in always creates a new connection. A user can hold two live connections for one provider account. A revoke and a new sign-in always change the connection id. The platform cannot know that two consents are the same account, unless the service tells it.

What changes

• Service gets an opt-in identity_key classvar beside identity_endpoint. It names the identity fact that identifies the provider account: "sub" for Google, "id" for GitHub. One line per service. There is no cross-provider key list — a generic guess can attach a fresh consent to the wrong row, so Revoking a connection is a state the row keeps, not a deletion #302 deleted one.
• With the key declared, the OAuth callback compares a fresh sign-in's identity with the owner's existing connections for the provider. On a match, the sign-in updates that row: a live row gets the new tokens, a revoked row becomes live again under its old id, and the callback evicts the cached access token. With no match, no key, or no key value in the identity facts, the callback creates a new connection as before.
• A live row wins over revoked rows when both match. Among revoked rows, the latest consent wins.
• The matched path publishes oauth.connected with reconsent=true. That is the flag's documented meaning: the consent replaced an existing connection's tokens.

A live match updates the row; it is not refused. The consent already happened, and a refusal would discard a completed grant. The update keeps the connection id stable.

No schema change: the lookup reads the existing identity JSONB. Documented beside identity_endpoint in writing-an-extension.md.

Verification

• ruff check / ruff format --check: clean
• New tests: a keyed match makes a revoked row live again; a live row gets the new tokens and loses its cached access token; a live match wins over a revoked match; a missing key value creates a new row. The existing new-row-per-sign-in tests pass unchanged.

🤖 Generated with Claude Code