provision when the account list changes, not only when you connect

Receiving users:list updated an in-memory array and did nothing else, so a
person added to Officer next month reached Photos only if somebody remembered
to re-run provisioning by hand. The platform already broadcasts on every create
and delete, and re-sends on every sidecar registration — nothing was listening.

Now it acts on it. A restart is therefore also a reconciliation, which is the
cheap way to recover from any push that was missed while the sidecar was down.

An automatic run is NOT allowed to key an adopted account. Keying one means
resetting its password, because that is the only way Immich issues a key, and
for an account that pre-dated Officer that takes away a login somebody is using
— most likely in Immich's own app. Doing that unattended, to a person who did
not know it was at stake, is not the same act as the owner choosing it: so the
account is linked, left keyless, and named in `pending`. The deliberate
/provision route still does the whole job.

Tested against the case this is for: jrg.conceicao has an Immich library and no
Officer account today. When that account exists, the plan adopts the library
rather than building a second one beside it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sidecar/config.ts

@@ -161,7 +161,7 @@ async function addAccount(req: Request, userId: number): Promise<Response> {
     // The trigger is registering an ADMIN connection, not installing the plugin: at install time there is
     // no credential, so there is nothing to provision with. Awaited, so the response says what happened —
     // and, importantly, carries the temporary passwords, which exist nowhere else.
-    const provisioning = await runProvisioning({ cfg: { base: url, key: apiKey }, configId: account.id });
+    const provisioning = await runProvisioning({ cfg: { base: url, key: apiKey }, configId: account.id, keyAdopted: true });
     return Response.json({ account, user: result.user, provisioning });
   } catch (err) {
     if (duplicateLabel(err)) return bad(`you already have an account called "${label}"`);
@@ -211,7 +211,7 @@ async function reprovision(userId: number, id: number): Promise<Response> {
   if (!creds) return bad('no such account', 404);
 
   const cfg = { base: normalizeBase(creds.url), key: creds.apiKey };
-  const provisioning = await runProvisioning({ cfg, configId: id });
+  const provisioning = await runProvisioning({ cfg, configId: id, keyAdopted: true });
   const keys = await backfillAccountKeys({ cfg, configId: id });
 
   return Response.json({ provisioning, keys });