feat(token): support link_identity in the access_token grant

[spydon]

What

Adds link_identity support to the access_token grant, so an already-authenticated user can attach a provider identity (Facebook) to their existing account using a provider access token, instead of signing in or creating a new account.

POST /token?grant_type=access_token
Authorization: Bearer <current user session>
{ "provider": "facebook", "access_token": "<facebook access token>", "link_identity": true }

Why

Parity with the id_token grant, which already supports link_identity. This lets a user who signed in another way (email, another provider) connect their Facebook account when native login only yields a classic access token (the case #2609 exists for).

How

Mirrors the id_token grant exactly:

• When link_identity is set, require a valid user access token in the Authorization header (requireAuthentication), resolve the target user, and set it on the context.
• In the transaction, branch to linkIdentityToUser instead of createAccountFromExternalIdentity.

Tests

• TestAccessTokenGrantLinkIdentity: links Facebook to an existing signed-in user, asserts the same user is returned and the facebook identity is attached.
• TestAccessTokenGrantLinkIdentityRequiresAuth: linking without an Authorization header is rejected.

Stacking

Stacked on #2609 (base branch feat/facebook-access-token-grant). Review/merge that one first; this diff is only the linking addition.