fix: race-proof user creation + unique Identity index + collection extension point

[poxet]

Summary

Resolves #65. Closes the check-then-act race in UserServiceRepositoryBase.GetUserAsync that produces duplicate UserEntity rows when two near-simultaneous first-time logins for the same identity hit a fresh per-environment User collection.

• Unique Identity index declared on UserRepositoryCollection.Indices. Tharga.MongoDB's AssureIndex creates and maintains it.
• Race-proof GetUserAsync — catches MongoWriteException with WriteError.Category == ServerErrorCategory.DuplicateKey from AddAsync, re-reads by Identity, and returns the winning row.
• Consumer-facing index extension point — UserRepositoryCollection<TUserEntity> is now public; subclass it to declare per-deployment indices. Register the subclass via the new ThargaTeamOptions.RegisterUserRepository<TUserEntity, TCollection>() overload. See the new "Adding per-deployment User indices" section in Tharga.Team.MongoDB/README.md.

⚠️ Migration prerequisite

Existing deployments with duplicate User rows must dedupe before upgrading. The unique Identity index will fail to create against conflicting data; Tharga.MongoDB's AssureIndex surfaces this in startup logs and refuses to apply the index until the data is clean.

Recommended cleanup (mongosh, per affected database):
```js
db.User.aggregate([
{ $group: { _id: "$Identity", ids: { $push: "$_id" }, count: { $sum: 1 } } },
{ $match: { count: { $gt: 1 } } }
])
```
Then delete all but the earliest `_id` per group (or whichever row is canonical).

Behaviour change for consumers

• UserServiceRepositoryBase constructor unchanged. Existing subclasses (UserService in consumer projects) compile without change.
• ThargaTeamOptions.RegisterUserRepository<TUserEntity>() continues to register the built-in collection. The new <TUserEntity, TCollection>() overload is opt-in.
• UserRepositoryCollection<TUserEntity> is now public (was internal). Source-compatible promotion.

Consumer cleanup unlocked (separate downstream bumps)

• Quilt4Net.Server can remove its UserIdentityIndexHostedService (it created the index out-of-band) and its MongoWriteException/DuplicateKey catch in UserService.GetUserAsync (defensive code that becomes redundant). Tracked downstream.

Out of scope

• FindOneAndUpdate \$setOnInsert upsert path — both approaches close the race; catch-DuplicateKey is the chosen minimal change.
• Built-in dedupe-on-startup migration — admins clean duplicates manually.
• Symmetric fix for `TeamRepository` user-key races — the Team collection already has a unique `UniqueTeamMemberKey` index.

Test plan

• `dotnet build -c Release` — 0 warnings, 0 errors
• `dotnet test -c Release` — 296 / 296 passing (7 new tests)
• New `Tharga.Team.MongoDB.Tests` project added to the solution
• `UserServiceRepositoryBaseRaceTests` (4 tests) — no-existing-user, existing-user, add-throws-DuplicateKey-re-reads-winner, add-throws-non-DuplicateKey-propagates
• `RegisterUserRepositoryTests` (2 tests) — default overload registers built-in collection; subclass overload registers consumer subclass
• `UserRepositoryCollectionIndicesTests` (1 test) — `Indices` contains exactly the expected unique `Identity` index

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!