fix(sharing): bind enrolled devices to identities

[kunickiaj]

Description

Persist an authoritative Identity binding for enrolled recipient devices across BetterSQLite and D1.

The coordinator now mints an opaque Identity for each Team-member invitation, exposes it during inspection, requires that exact Identity during acceptance, and atomically stores it on the enrolled device. Add-device invitations continue to use their coordinator-owned target Identity. Legacy, admin, and Project enrollment remains unbound.

This prevents recipients from choosing or silently rebinding the Identity later trusted by signed coordinator mutations. Malformed migrated assignments, caller-supplied Team assignments, conflicting re-enrollment, and mismatched join responses fail closed.

Type of Change

• 🚀 Feature (new functionality)
• 🐛 Bug fix (fixes an issue)
• 📚 Documentation (docs-only change)
• 🔧 Maintenance (refactor, chore, CI, etc.)
• 🧪 Testing (test-only changes)

Testing

• Relevant checks pass locally (pnpm run tsc, pnpm run lint, pnpm run test)
• Added/updated tests for changes
• Manually verified changes work as expected

Additional validation:

• pnpm --filter @codemem/cloudflare-coordinator-worker test:worker
• Independent security/correctness, test-coverage, and maintainability reviews

Checklist

• Code follows project style (pnpm run lint passes for touched files)
• Self-review completed
• Documentation updated (if needed)
• No new warnings introduced

[kunickiaj]

• fix(sharing): preserve invitation completion state #1359
• feat(sharing): authorize identity-owned device invites #1358
• fix(sharing): bind enrolled devices to identities #1357 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.