fix(oauth): auto-bind verified external login to existing active user by email

[renich]

Proposed Changes

• When an external OAuth connector authenticates a user and returns a verified email address matching an existing active local user account, automatically bind the external identity to that account instead of returning UserAccessDenied (/50x?title=Access%20denied&msg=Access%20denied).
• Update last_login_date for the existing user.
• Activate the user's email status if it was in EmailStatusToBeVerified.
• Issue and return the login access token directly so the user is seamlessly logged into their existing account.

Motivation & Context

Previously, if a user had registered using email/password (or was created during initial site setup), and subsequently attempted to log in using an OAuth connector (e.g., "Continue with Google"), Apache Answer aborted in ExternalLogin:

	if _, exist, err := us.userRepo.GetByEmail(ctx, externalUserInfo.Email); err != nil {
		return nil, err
	} else if exist {
		return &schema.UserExternalLoginResp{
			ErrTitle: translator.Tr(handler.GetLangByCtx(ctx), reason.UserAccessDenied),
			ErrMsg:   translator.Tr(handler.GetLangByCtx(ctx), reason.UserAccessDenied),
		}, nil
	}

This redirected users to /50x?title=Access%20denied&msg=Access%20denied, requiring them to realize they had to log in with their password first, navigate to Settings -> Account, and manually link the third-party provider.

For non-technical communities and modern SSO expectations, this creates friction and confusion. Connectors already verify email ownership (for example, connector-google checks respGoogleAuthUserInfo.EmailVerified before setting userInfo.Email). Automatically binding verified OAuth emails to existing active accounts provides a seamless single sign-on experience.

---

Co-authored with Antigravity AI (Google DeepMind).