Unify user management and add reviewed identity repairs

docs/user-identities.md

@@ -32,3 +32,28 @@ audit record. A changed preview must be checked again. Existing confirmed or
 conflicting stored identities cannot be replaced using this flow. Missing upstream
 records must be corrected in their service before confirmation is available.
 No accounts are created, merged or deleted; emails are not used to infer identity.
+
+
+### User Management and repairs
+
+Identity checks now live at **Config > User management > Account links & repairs**.
+The old `/admin/identities` link redirects there. Choose **Review repair** on a
+missing or conflicting account, select the authoritative Jellyfin identity, and
+preview the current and proposed Magent links. Saving rechecks live service IDs,
+all local owners, the server identity and concurrent changes. Repairs retain an
+atomic before/after audit in `user_identity_repairs`. Changing a Jellyfin identity
+revokes identity-bound email subscriptions; users must opt in again.
+
+If a person has never had a Seerr account, explicitly choose the single-account
+import option and preview again. Confirmation imports only that Jellyfin ID via
+Seerr's supported API and rechecks its resulting Seerr ID before saving Magent.
+Seerr and Magent cannot share a transaction: if an import succeeds but the local
+save fails, the imported account is retained and the administrator must recheck.
+No automatic deletion or rollback of upstream accounts is attempted.
+
+For an existing Seerr account with a different Jellyfin ID, inspect its ID in the
+preview and reconnect that existing account in Seerr using the account owner's
+Jellyfin sign-in. Magent cannot rewrite Seerr's Jellyfin ID through the normal
+admin user-update endpoint. Do not import another account to bypass a mismatch.
+Duplicate Magent owners remain blocked until the ownership conflict is resolved;
+this workflow does not merge users, permissions, requests or playback history.