feat: add identity and personal workspace provisioning

[seonghobae]

Summary

Adds the provider-neutral identity domain needed before implementing Google and GitHub OAuth callbacks.

Included

• opaque UUIDv4 internal IDs for users, external identities, and workspaces
• strict separation between provider subjects and internal primary keys
• idempotent account lookup by (provider, providerSubject)
• automatic personal workspace provisioning on first sign-in
• PostgreSQL uniqueness constraints for external identities and personal workspaces
• unit tests for provisioning, idempotency, external numeric subjects, and validation

Security properties

• numeric provider IDs are accepted only as external attributes and are never reused as internal IDs
• internal IDs are random UUIDv4 strings
• one provider identity maps to one internal account
• one personal workspace is allowed per owner

Validation

• CI: passed
• SAST Semgrep: passed
• Security Scan: passed
• CodeRabbit review completed with no actionable review threads

Merged after required checks and review verification.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 54 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ad146d39-28fe-43b6-a90d-29ece7856ba1

📥 Commits

Reviewing files that changed from the base of the PR and between 9942404 and 945a2fc.

📒 Files selected for processing (4)

• apps/identity-service/migrations/0001_initial_identity.sql
• apps/identity-service/src/identity-domain.test.ts
• apps/identity-service/src/identity-domain.ts
• docs/superpowers/plans/2026-08-03-identity-workspace-slice.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.