feat(admin): remove the SSO link of an account whose provider changed its subject

A sign-in with another subject of the same provider is refused, so an
account whose provider re-issued the subject (a migrated or rebuilt IdP, a
changed sub format) was locked out: editing the email, as the wiki advised,
never touched the stored link. The edit dialog now offers "Remove SSO link"
for other accounts while SSO is set up (DELETE /api/admin/users/:id/sso,
audit admin.user_sso_unlink). The next SSO sign-in links again under the
rules of a first one, so it still needs a verified, not self-set email.
The log line names the remedy, and the wiki tells the two refusals apart.

Fixes #3065

server/src/nest/admin/admin.controller.ts

@@ -156,6 +156,22 @@ export class AdminController {
     return { success: true };
   }
 
+  @Delete('users/:id/sso')
+  async unlinkUserSso(@CurrentUser() user: User, @Param('id') id: string, @Req() req: Request) {
+    const result = await this.admin.unlinkUserSso(id, user.id);
+    if (result.unlinked) {
+      await this.audit.writeAudit({
+        userId: user.id,
+        action: 'admin.user_sso_unlink',
+        resource: String(id),
+        ip: getClientIp(req),
+        details: { targetUser: result.email },
+      });
+      logInfo(`Admin ${user.email} removed the SSO link of user ${result.email}`);
+    }
+    return { success: true, unlinked: result.unlinked };
+  }
+
   // ── Stats / permissions / audit ──
   @Get('stats')
   stats() {