hmp-core: Match returning players by any announced client ID

[Kheartz]

Problem

A server owner reported players randomly losing their characters. The client announces only the IDs it detected on that launch, so one session can carry Steam or Discord and the next only a hardware ID (with the nickname Player). hmp-core keyed the account on the first ID in identityOrder and stored no others, so the hardware-only session matched nothing and got a new, empty account. The old characters stayed on the original account.

Change

• Every client-announced ID is linked to the account, and later sessions match through any of them, ranked by identityOrder.
• An account first created from a lower-ranked ID (e.g. hardware only) is adopted when a higher-ranked one (Steam) appears, and the new ID is linked to it.
• If the higher-ranked ID is new but the matching account already holds a different ID of that kind, it's a second player on a shared machine, and they get their own account.
• IDs already linked to another account are never moved. The server logs Account X shares a <provider> ID with account Y; the accounts were not merged so staff can find and reconcile accounts split before this fix.
• Verified providers registered through identity.register are unaffected and still match on their own principal only.

Removing hardwareId from identityOrder stops hardware IDs from being matched or linked, for owners who'd rather not tie accounts to a machine. The README and CHANGELOG cover the behaviour.

Accounts already split by the old behaviour aren't merged automatically. With the player offline, staff can move the stray account's identities with UPDATE hmp_account_identities SET account_id = <original> WHERE account_id = <stray>;.

Testing

• New hmp-core tests: fewer IDs on a later session, adopting a hardware-only account, players on a shared machine. All three fail on main and pass here.
• npm test and npm run typecheck pass in all 28 resources; hmp-core build and smoke pass.