feat(iam): provision authorized first-login users as medical assistants

server/database/migrations/20260910_iam_local_identity.sql

@@ -0,0 +1,10 @@
+-- Apply once before enabling the new adapter. Replace zyt_ only if database.prefix differs.
+-- Do not drop this ledger while IAM-created accounts exist: it is retry/deduplication state.
+CREATE TABLE IF NOT EXISTS `zyt_iam_local_identity` (
+  `identity_key` char(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+  `identity_value` text NOT NULL,
+  `admin_id` int unsigned DEFAULT NULL,
+  `create_time` int unsigned NOT NULL,
+  PRIMARY KEY (`identity_key`),
+  UNIQUE KEY `uniq_iam_admin` (`admin_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;