Existing users can claim course access securely

No old passwords are migrated.

No fake passwords are created.

Course entitlements are pre-granted after admin import.

Identity is verified by same email, Google login, reset link, invite link, claim code, or manual admin link.