Fix account-takeover: bind users to nextcloud_id, not email

Matching users by email alone allows an attacker with a self-registered
Nextcloud account to hijack any Filament user. Now we look up by
nextcloud_id first; email is only used when creating a brand-new account,
and nextcloud_id is immediately written to the row so future logins
use the stable Nextcloud user ID.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

database/migrations/2026_09_13_100000_add_nextcloud_id_to_users.php

@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->string('nextcloud_id')->nullable()->unique()->after('email');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn('nextcloud_id');
+        });
+    }
+};