feat(shared): auth_source constants and hq_user_id on User

Nothing writes them yet. They land now so phases 2 and 3 do not require a
second rebuild of every service that consumes the shared module.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/models/user.go

@@ -10,4 +10,10 @@ const (
 	RoleMember = shared.RoleMember
 )
 
+const (
+	AuthLocal = shared.AuthLocal
+	AuthOIDC  = shared.AuthOIDC
+	AuthHQ    = shared.AuthHQ
+)
+
 func ValidRole(role string) bool { return shared.ValidRole(role) }

shared/models/user.go

@@ -20,6 +20,17 @@ func ValidRole(role string) bool {
 	return false
 }
 
+// Auth sources. A user's auth_source says who owns the row.
+const (
+	AuthLocal = "local"
+	AuthOIDC  = "oidc"
+	// AuthHQ marks a user projected from a Vantage HQ account. Its role,
+	// password and existence are owned by HQ, and the instance API refuses to
+	// change any of them locally — a role editable in two places is a role with
+	// two answers.
+	AuthHQ = "hq"
+)
+
 type User struct {
 	ID           bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
 	UserID       string        `bson:"user_id" json:"user_id"`
@@ -28,6 +39,9 @@ type User struct {
 	PasswordHash string        `bson:"password_hash,omitempty" json:"-"`
 	Role         string        `bson:"role" json:"role"`
 	AuthSource   string        `bson:"auth_source" json:"auth_source"`
-	CreatedAt    time.Time     `bson:"created_at" json:"created_at"`
-	LastLogin    *time.Time    `bson:"last_login,omitempty" json:"last_login,omitempty"`
+	// HQUserID is the customer_users.user_id this row was projected from,
+	// absent on locally-created users.
+	HQUserID  string     `bson:"hq_user_id,omitempty" json:"hq_user_id,omitempty"`
+	CreatedAt time.Time  `bson:"created_at" json:"created_at"`
+	LastLogin *time.Time `bson:"last_login,omitempty" json:"last_login,omitempty"`
 }