Add command to sync users with ConCat volunteers

[travismolick]

Adds auth:sync-concat, an artisan command that syncs Tracker users with ConCat's volunteer list.

What it does

• Creates Tracker users for ConCat volunteers who don't have one yet
• Refreshes usernames and badge names for existing users
• Promotes Attendees to Volunteer, and volunteers flagged isStaff in ConCat to Staff
• Demotes Volunteer/Staff users missing from ConCat's volunteer list to Attendee
• Never changes Banned, Lead, Manager, or Admin roles, and skips soft-deleted users

Real names are never copied from ConCat, to avoid storing more PII. New users get the existing "Unidentified " placeholder, and demoted users keep their current names.

Safety

• Only previews changes by default; pass --apply to save them.
• All changes are saved in one transaction and recorded in the activity log.
• Refuses to run if ConCat returns no volunteers, since that would demote everyone.

Known limits

• isStaff only comes from volunteer applications, so staff without one are demoted.
• Logging in with ConCat promotes an Attendee back to Volunteer (Prevent use of Tracker by users without a volunteer application #32 would change that).
• Partially covers Associate ConCat roles with Tracker roles #27 (staff promotion only).

Testing

• Feature tests cover the dry run, apply, role protection, demotion, deleted users, and the empty-list guard.

Running it

php artisan auth:sync-concat           # preview
php artisan auth:sync-concat --apply   # save

Requires the ConCat OAuth app to have the user:read, volunteer:read, and registration:read scopes. Back up the database before applying.