feat(migrate): import users from an existing identity system

[Bccorb]

Part of fells-code/seamless-auth-api#334. Depends on fells-code/seamless-auth-api#336 (bulk import endpoint).

Problem

Moving an organization onto Seamless Auth starts with getting its users out of the current system. There is no tooling for that today.

Proposal

A seamless migrate command that reads users from a source, maps them, and imports them through the bulk import endpoint.

• Sources, in order:
  1. CSV (covers HR and payroll exports, and anything else as a fallback)
  2. Microsoft Entra ID (Microsoft Graph)
  3. Google Workspace
  4. Okta
  5. Auth0, AWS Cognito, Firebase Auth, Keycloak realm export
• Mapping file: which source fields become email, phone, display name, roles and organization, kept in the repo of the migration so it can be re-run
• --dry-run by default on first run, showing what would be created, updated, skipped and rejected
• Report: a file (CSV and JSON) of every row and its outcome, written so it can be handed to the organization as a migration artifact
• Re-runnable: idempotent on the source system's user ID
• Never reads or exports passwords or password hashes, even where the source offers them

Notes

• Start with CSV and Entra ID. Each additional source can be its own follow-up issue.
• Source credentials (Graph app secret, Okta token) come from env vars or the profile, never flags, so they stay out of shell history.

[Bccorb]

CSV is in the draft PR linked above. Microsoft Entra ID is split out to #213; the other sources (Google Workspace, Okta, Auth0, Cognito, Firebase, Keycloak) can each follow as their own issue on the same core.

[Bccorb]

The core and the CSV source shipped in #214. Microsoft Entra ID continues in #213, and the remaining sources can each follow as their own issue on the same core.