Converge assignee/member identity (app_user per tenant_member)

Assignees are app_user rows (Linear-synced); workspace members are tenant_member (Keycloak identity) — two separate systems. UI-created (native) workspaces have no app_user rows, so you can't assign anyone there. Before Linear is gone, provision an app_user per tenant_member (or merge the concepts) so assignment works workspace-wide and survives ejection.