Support configured directory service principals

[jaykaycodes]

Summary

• add validated DIRECTORY_SERVICE_PRINCIPALS core configuration
• overlay configured identities without persisting them as surface-owned directory rows
• preserve configured identities across Slack directory replacement while retaining explicit deactivation
• prevent canonical/Slack alias collisions and remove identities immediately when configuration is removed

This provides an explicit service-identity path for Slack-less and mixed-surface deployments related to #153 without treating every OIDC login as a directory member.

Verification

• npm test (3717 tests, 3585 passed, 132 skipped, 0 failed)
• npm run typecheck
• npm run lint -- --quiet
• Prettier check on affected files
• independent fresh-context review: no findings after two review-driven fixes

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}