Add the Identity foundation

[pournasserian]

Closes #2440

What

The part of F-USR (#2428) that needs no screen, so it lands before the admin shell.

• Core: the initiator model from ADR-0009 (Initiator, UserInitiator, AgentInitiator, ICurrentInitiator) with ClaimsInitiator.From(principal), where an agent credential claim always wins over a user id so an agent can never be recorded as a person. FluentCmsRoles.Administrator, Result / Result<T> / Error, and the IFirstRunSetup and IUserDirectory services.
• Infrastructure: ASP.NET Core Identity stores on EF Core (FluentCmsUser with display name, FluentCmsRole, Guid keys, tables named Users, Roles, ...). The DbContext is now an abstract IdentityDbContext with a SQLite and a PostgreSQL subclass, each with its own migrations folder and a design-time factory, selected once at startup by the existing provider configuration. The first migration, Identity, for both providers. UserDirectory (create, list, disable through lockout) and FirstRunSetup.
• Host: ICurrentInitiator resolved from the request's claims in the web host; the stdio host has no initiator until F-MCP issues agent credentials.
• Tooling: dotnet-ef as a local tool in .config/dotnet-tools.json; CONTRIBUTING.md documents how to add a migration for both providers.

Why

F-AUD (#2424) needs the principal model and sign-in needs the user store; neither needs a page. Landing the per-provider migration strategy now means the next epics add tables the same way.

Tests

Unit: claims mapping for a user, an agent beside a user id, and anonymous principals; result semantics. Integration: migrations apply on SQLite and on PostgreSQL in CI, the first administrator is created once and holds the Administrator role, users are created, listed and disabled, a weak password is rejected with Identity's error codes, and an unknown provider fails at startup. Both host modes still start, which now exercises the migrator with a real migration.

Checklist

• Linked to an issue a maintainer has confirmed
• Targets v2
• Tests or docs updated where behaviour changed
• No tool-generated co-author trailers or footers