feat: harden SaaS authentication and authorization

Tiku.Domain/Identity/User.cs

@@ -1,20 +1,35 @@
 using System.Text.Json;
+using Microsoft.AspNetCore.Identity;
 using Tiku.Domain.Common;
 
 namespace Tiku.Domain.Identity;
 
-public sealed class User : AuditableEntity
+public sealed class User : IdentityUser<Guid>, IHasTimestamps
 {
+    public User()
+    {
+        Id = Guid.NewGuid();
+        SecurityStamp = Guid.NewGuid().ToString("N");
+        ConcurrencyStamp = Guid.NewGuid().ToString("N");
+    }
+
     public string? LegacyId { get; set; }
-    public string? Username { get; set; }
-    public string? Email { get; set; }
     public string? Phone { get; set; }
     public string? Name { get; set; }
     public string? AvatarUrl { get; set; }
     public string PrimaryRole { get; set; } = "student";
     public int Score { get; set; }
     public DateTimeOffset? LastSeenAt { get; set; }
-    public string? LegacyPasswordHash { get; set; }
-    public bool PasswordMigrationRequired { get; set; }
+    public UserStatus Status { get; set; } = UserStatus.Active;
+    public bool ForcePasswordChange { get; set; }
     public JsonElement RawProfile { get; set; } = JsonDefaults.Object();
+    public DateTimeOffset CreatedAt { get; set; } = DateTimeOffset.UtcNow;
+    public DateTimeOffset UpdatedAt { get; set; } = DateTimeOffset.UtcNow;
+}
+
+public enum UserStatus
+{
+    Active,
+    Disabled,
+    Archived
 }