docs: accept ADR 0058 on the bind of the identity subject to the account at login

[FSM1]

@coderabbitai ignore

Summary

• The owner ordered this ADR on 2026-09-29. The owner reviewed this PR and accepted ADR 0058 on 2026-09-29, with the residuals E1 and E2 open. The status line and the README row read "Accepted on 2026-09-29".
• The owner confirmed the drop of identity_subjects.identifier_display again on 2026-09-29. The truncated identifier that the settings pane shows comes from auth_methods.identifier_display, which does not change.
• ADR 0058: the identity subject binds to the account at login, and a device registration reads the bind. D1 puts the bind in users.identity_subject_id (unique, one subject per account). D2 makes a login that follows an identity exchange present the identity token and bind an unbound account to an unbound subject. D3 makes a device registration refuse an unbound account and a token of another subject.
• The bind does not close the first-claim race. It shrinks the window from "until the first registration" to the seconds between the mint and the first login. Residual E1 asks the owner whether to close it with a proof-of-possession claim. Residual E2 asks about recovery of a subject that is bound to the wrong account.
• ADR 0039: D2 gets an "Amended by ADR 0058 D3" sentence. E2 and E4 are corrected in place: the display column is dropped, a registration spends the token, and the relay session endpoint accepts it more than once.
• blueprint/api.md: "Identity and auth" gets one fact line for the single-use rule, and "Data model (complete)" names spent_identity_tokens (token_id, expires_at). The bind is not built, so the blueprint does not describe it. The slice that builds the bind adds it (Consequence 1).
• The E2 and E4 corrections and the two blueprint lines describe the code of PR fix(api): spend the identity token at registration and drop the subject display column #2092. This PR merges after PR fix(api): spend the identity token at registration and drop the subject display column #2092. A trial merge with the head of fix(api): spend the identity token at registration and drop the subject display column #2092 (fc7dc47) has no conflict.
• The bind itself is one later slice under api: a leaked identity token lets another account claim a member's subject first #2012.

Test plan

• pnpm lint:md
• npx prettier --check "decisions/*.md" "blueprint/*.md"
• pnpm lint:tracker-refs
• The ADR has 116 lines (under 120) and no Gate section.

Part of #2012.

Note

Add proposed ADR 0058 binding the identity subject to the account at login

• Adds ADR 0058, proposing a nullable unique account-to-identity-subject binding on users, written once at a login with a verified identity token when both sides are unbound
• Device registration reads the binding and returns a conflict without writing when the account is unbound or the token subject differs; conflicting bindings never alter the account
• The ADR covers token spending at registration, alternatives, API/client/web/desktop consequences, migration, privacy, and residual first-claim and recovery risks
• Updates ADR 0039 and the decision index, and records the single-use token rule in the API docs
• Risk: none at runtime; the binding behavior is proposed only — registration token spending is already implemented, the binding itself is not yet built

^{Macroscope summarized d51410b.}