Keep the OIDC `sub` claim immutable after user creation

A signed-in user with write access to their own User record could change their OIDC `sub` and be seen as another account. The `sub` is now re-asserted from the stored value on every save and can no longer be changed once generated.