fix(account): dedupe colliding identities on merge, journaling to the dossier

An account merge blanket-reassigned all of the secondary's identities to the primary,
so merging two accounts that each had a confirmed email (or telegram/vk) left the
survivor with two identities of one kind — which the profile and the retention dossier
both treat as singular (the profile showed an arbitrary one; a later change-email
journaled only one). The merge now keeps the primary's identity and journals the
secondary's colliding one to retained_identities (reason=merge) before dropping it, so
the survivor has one identity per kind and the absorbed credential still lands in the
legal dossier.

- migration 00008: widen retained_identities.reason CHECK to admit 'merge'
  (expand-contract — Up only widens the set, so an image rollback stays DB-safe).
- accountmerge: dedupeIdentities + retainMergedIdentity before the identity reassign.
- inttest TestAccountMergeDedupesEmail; docs ARCHITECTURE §4 + retention.go reason note.

docs/ARCHITECTURE.md

@@ -292,8 +292,11 @@ arrive from a platform rather than completing a mandatory registration).
   invitations / friend-codes / drafts / pending-codes. **Chat, feedback and complaints are
   kept.** The orchestration a layer up resigns the account's active games (so opponents are
   not stranded), **drops its all-robot games** (no human opponent; children cascade), and
-  revokes its sessions. Every credential detachment — **unlink, email change and delete** —
-  writes a `retained_identities` row (`reason`), so the dossier keeps the full timeline.
+  revokes its sessions. Every credential detachment — **unlink, email change, delete and a
+  merge collision** — writes a `retained_identities` row (`reason`), so the dossier keeps the
+  full timeline. (A merge that would otherwise leave the survivor with two identities of one
+  kind — e.g. each account held a confirmed email — keeps the primary's and journals the
+  secondary's with `reason=merge` before dropping it.)
   Step-up is a mailed code (`purpose=delete`, no deeplink — a stray click must not delete;
   `ConfirmByToken` refuses a delete token) for an email account, else a typed phrase.
   `last_login_at` / `last_login_ip` are stamped on the cold-load profile fetch (throttled