Add migration to add auth_user_id column to users table

- Introduced a new column 'auth_user_id' of type UUID to the 'users' table.
- Updated existing user data to set 'auth_user_id' to null for UserId 1.
- Created a unique index on 'auth_user_id' to enforce uniqueness.
- Implemented rollback functionality to remove the column and index if needed.

Backend/ERPCore/Domain/Entities/User.cs

@@ -3,18 +3,23 @@ using ERPCore.Domain.Enums;
 namespace ERPCore.Domain.Entities;
 
 /// <summary>
-/// Application user (FR-X-01). In Phase 1 authentication/RBAC are deferred; this
-/// table exists so mutations can be stamped with an audit actor and documents can
-/// carry a `createdBy`/`requestedBy` FK. A seeded <c>system</c> user (id 1) is the
-/// fallback actor until `/auth/login` lands (§6). Model: docs/10 Part C.7.
+/// Application user (FR-X-01) — a **local shadow/projection** of an AuthHex identity.
+/// The local <see cref="UserId"/> (long) is what every `createdBy`/`requestedBy`/
+/// audit/ledger FK references; <see cref="AuthUserId"/> maps it to the AuthHex
+/// <c>UserId</c> (GUID) and is JIT-provisioned on first authenticated request
+/// (docs/10 A.4/C.7). A seeded <c>system</c> user (id 1, null AuthUserId) is the
+/// fallback actor for unauthenticated/system operations. Model: docs/10 Part C.7.
 /// </summary>
 public class User
 {
-    /// <summary>Seeded fallback actor used while auth is deferred.</summary>
+    /// <summary>Seeded fallback actor for unauthenticated/system operations.</summary>
     public const long SystemUserId = 1;
 
     public long UserId { get; set; }
     public string Username { get; set; } = string.Empty;
     public string DisplayName { get; set; } = string.Empty;
     public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    /// <summary>AuthHex identity (token <c>UserId</c> GUID); null for the seeded system user.</summary>
+    public Guid? AuthUserId { get; set; }
 }