provision when the account list changes, not only when you connect

Receiving users:list updated an in-memory array and did nothing else, so a
person added to Officer next month reached Photos only if somebody remembered
to re-run provisioning by hand. The platform already broadcasts on every create
and delete, and re-sends on every sidecar registration — nothing was listening.

Now it acts on it. A restart is therefore also a reconciliation, which is the
cheap way to recover from any push that was missed while the sidecar was down.

An automatic run is NOT allowed to key an adopted account. Keying one means
resetting its password, because that is the only way Immich issues a key, and
for an account that pre-dated Officer that takes away a login somebody is using
— most likely in Immich's own app. Doing that unattended, to a person who did
not know it was at stake, is not the same act as the owner choosing it: so the
account is linked, left keyless, and named in `pending`. The deliberate
/provision route still does the whole job.

Tested against the case this is for: jrg.conceicao has an Immich library and no
Officer account today. When that account exists, the plan adopts the library
rather than building a second one beside it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sidecar/reconcile.test.ts

@@ -109,6 +109,34 @@ describe('matching', () => {
   });
 });
 
+// The planned case: an Immich account that exists today with no Officer login, whose person gets an
+// Officer account later. Provisioning must adopt it rather than build a second library beside it.
+describe('an Immich-only account whose owner joins Officer later', () => {
+  const joined = [...PLATFORM, user(28, 'jorge', 'jrg.conceicao@gmail.com')];
+  const plan = planReconcile({
+    users: joined,
+    immichUsers: IMMICH,
+    existing: [
+      { userId: 24, immichUserId: 'aaaa1111' },
+      { userId: 26, immichUserId: 'bbbb2222' },
+    ],
+    adminImmichUserId: ADMIN_ID,
+  });
+
+  test('links them to the photographs they already have', () => {
+    expect(plan.link.map((l) => l.user.id)).toEqual([28]);
+    expect(plan.link[0]!.immich.id).toBe('cccc3333');
+  });
+
+  test('does not create a second account for the same address', () => {
+    expect(plan.create.map((u) => u.email)).not.toContain('jrg.conceicao@gmail.com');
+  });
+
+  test('stops reporting them as belonging to nobody', () => {
+    expect(plan.leave).toHaveLength(0);
+  });
+});
+
 describe('an account deleted in Immich behind Officer’s back', () => {
   const plan = planReconcile({
     users: PLATFORM,