fix: harden user linking and session pruning

Security:
- Add unique constraint on headscale_user_id to prevent hijacking
- linkHeadscaleUser now rejects already-claimed Headscale users
- Onboarding dropdown filters out claimed users
- onboarding-skip action redirects on rejected claims

Maintenance:
- Replace probabilistic session pruning with setInterval (15m)
- Move pruning out of request path into server startup

Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019cce57-c9e1-7732-9709-8288127573a9

app/routes/auth/oidc-callback.ts

@@ -80,9 +80,7 @@ export async function loader({ request, context }: Route.LoaderArgs) {
           })()
         : userInfo.picture;
 
-    const hasUsers = await context.auth.hasAnyUsers();
-    const defaultRole = hasUsers ? "member" : "owner";
-    const userId = await context.auth.findOrCreateUser(claims.sub, defaultRole);
+    const userId = await context.auth.findOrCreateUser(claims.sub);
 
     try {
       const hsApi = context.hsApi.getRuntimeClient(context.oidc!.apiKey);