Fix Optix rehydration during login bootstrap

[gekiclaws]

Problem

Optix login/bootstrap was treating all re-hydrated identity fields as app-owned local data. In practice that caused two regressions: existing users could have Avenu-managed notifPrefs overwritten during Optix login, and renamed Optix teams could stay stale locally along with their mailbox display names.

Impact is limited to users coming through the Optix token login flow, but it directly affects persisted preference state and the correctness of team/mailbox names shown in the app.

Solution

Split the Optix sync path by ownership boundary. Existing users now keep Avenu-managed notifPrefs, while successful /api/optix-token logins continue to refresh only Optix-owned user fields. For new local users, the existing default notification preference still applies on first creation.

Added change detection in the repository sync paths so unchanged Optix payloads do not trigger redundant local writes. For teams, existing records now refresh name through the mailbox-sync path only when the Optix name actually changed, which keeps team mailbox display names aligned without rewriting unchanged rows.

The alternative of blindly rewriting user/team records on every login was rejected because it adds unnecessary write load and makes ownership boundaries less explicit.

Testing

• Manual testing steps performed
• Unit tests added/updated
• Integration tests added/updated
• Tested edge cases: unchanged Optix payload skips user writes, existing user sync preserves notifPrefs, updated phone/team membership still propagates, existing team rename updates team mailbox display name, unchanged team name skips writes

Risks

Risk is low because the change stays inside the Optix login/bootstrap path and adds explicit diff-based guards before writes. The main thing to watch is whether any downstream code depended on user or team updatedAt changing on every Optix login, because unchanged payloads now intentionally return without rewriting records.

Screenshots/Videos

No UI changes

Related

Fixes #68

---

Reviewer Notes

Focus review on the ownership boundary in upsert_user_from_external_identity(...) and the diff-based update behavior in the user/team repository sync paths. Local unit coverage passed for the repository and identity sync tests; backend.tests.unit.test_identity_controller could not run in this environment because prometheus_client is not installed locally.

[AutumnQiu99]

In the try block of upsert_user_from_external_identity in users_repository.py, shouldn't we use user_service.update_user and not just update_user_with_mailbox_sync since what if phone updates?