[grade=B urn:ump:bbfbsfru4nizg75wcxum7mwzhie6txhr22hw6jvz36wiihmgzmlq] P7 people store: dedupe upsert by providerUserId

Dogfood finding #3: upsertPerson resolved existing records by id only.
The wizard upserts a bootstrap admin AFTER a provider sync has already
created a person for the same Tailscale user (no id passed), so the same
providerUserId was duplicated into two records. Resolve existing by
providerUserId when no id is given; bootstrap Admin group + protectedAt are
preserved on the merge. New regression test; full suite 3414/3414.

dashcaddy-api/__tests__/network-people-store.test.js

@@ -82,6 +82,26 @@ describe('network-people-store: CRUD', () => {
     expect(list).toHaveLength(1); // merged, not duplicated
   });
 
+  test('upsertPerson merges by providerUserId when id is omitted (wizard after provider sync)', async () => {
+    const synced = await store.upsertPerson({
+      displayName: 'SamiAhmed7777',
+      providerUserId: 'ughVnuLDu621CNTRL',
+    });
+    expect(synced.groups).toEqual(['Admin']); // bootstrap identity
+
+    const fromWizard = await store.upsertPerson({
+      displayName: 'Sami Ahmed',
+      providerUserId: 'ughVnuLDu621CNTRL',
+    });
+
+    expect(fromWizard.id).toBe(synced.id);
+    expect(fromWizard.displayName).toBe('Sami Ahmed');
+    expect(fromWizard.groups).toEqual(['Admin']);
+    expect(fromWizard.protectedAt).toBe(synced.protectedAt);
+    const list = await store.listPeople();
+    expect(list).toHaveLength(1);
+  });
+
   test('updatePerson patches only provided fields', async () => {
     const p = await store.upsertPerson({ displayName: 'Bob', providerUserId: 'ts-2', groups: ['G'] });
     const u = await store.updatePerson(p.id, { displayName: 'Bobby' });