Binds pre-multi-tenancy singleton rows to one named OIDC subject, given at startup via an env var (wired in Task 11). No-ops once any user exists or on a genuinely fresh install.
