Fix two defects a production-clone dress rehearsal exposed

Streamed a clone of a production store into the smoke VM - 3.6 GB, 12,361
settings, 6 accounts across 9 domains - and migrated it 0.15.5 -> 0.16.14
with the tool's own phases. The migration succeeded. Two defects surfaced
that no smaller instance could have shown, plus one finding worth recording.

1. Account roles broke on production-shaped names. v0.16 stores an account
   as a local part plus a domain reference: a v0.15 account named
   "[email protected]" becomes name "john" with a domainId. The generator
   passed the full address and the server rejected it outright ("Invalid
   email local part"), failing the apply. The smoke instance used bare
   usernames - alice, bob - and never exercised this.

   Fixed to use the local part. And because local parts are unique only
   within a domain - [email protected] and [email protected] both become
   "postmaster" - an ambiguous one is now refused with a warning rather
   than risking an upsert that grants Admin to the wrong account. Verified
   on the clone: the one admin came out with roles {"@type": "Admin"} and
   the other five accounts untouched.

2. Cutover's health check conflated liveness with credentials. A config
   fallback-admin does not survive the migration - v0.16's config is a
   store pointer, so the old [authentication.fallback-admin] block simply
   ceases to exist - so the credentials supplied for the pre-migration
   instance came back 401 on the migrated one, and the check reported the
   service as never having answered. It had answered; it was up and serving
   on all ten ports. Liveness and credentials are now separate: any
   response proves the service is up, and credentials that stopped working
   are a warning that names this cause.

Also recorded: a failed apply leaves the store in bootstrap mode, where
only Bootstrap objects are accessible. A half-applied plan is not a
partially configured server but an unusable one.

Timing, which is the other reason to rehearse: the recovery-mode conversion
of that 3.6 GB store took 2 seconds. A migration window is dominated by
waiting and verification, not data volume.

No production data in this commit; fixtures use example.net and the shapes
involved.

internal/applyplan/roles.go

@@ -32,11 +32,27 @@ import (
 // own "@type" as well.
 func AccountRoleOperations(principals []backup.Principal) (ops []Operation, covered []string, warnings []string, err error) {
 	type change struct {
-		name    string
-		variant string
+		localPart string
+		domain    string
+		variant   string
+		source    string
 	}
 	var changes []change
 
+	// v0.16 stores an account as a local part plus a domain reference, not
+	// as the full address v0.15 uses for its principal name: a v0.15
+	// account named "[email protected]" becomes name "john" with a domainId.
+	// Passing the full address is rejected outright ("Invalid email local
+	// part"), which is how this was found - on a production clone, where
+	// accounts are named by address. The smoke instance used bare names and
+	// never exercised it.
+	localPartCount := map[string]int{}
+	for _, p := range principals {
+		if strings.EqualFold(p.Type, "individual") {
+			localPartCount[localPart(p)]++
+		}
+	}
+
 	for _, p := range principals {
 		if !strings.EqualFold(p.Type, "individual") {
 			continue // domains and groups don't carry these roles
@@ -50,30 +66,69 @@ func AccountRoleOperations(principals []backup.Principal) (ops []Operation, cove
 			// touch every account to no effect.
 			continue
 		}
-		changes = append(changes, change{name: p.Name, variant: variant})
+		local := localPart(p)
+		// Local parts are unique only within a domain, so an upsert matched
+		// on name alone could land on a different account that happens to
+		// share it - [email protected] and [email protected] both become
+		// "postmaster". Granting Admin to the wrong account is worse than
+		// granting it to none, so an ambiguous name is refused and
+		// reported rather than guessed at.
+		if localPartCount[local] > 1 {
+			warnings = append(warnings, fmt.Sprintf(
+				"account %q: %d accounts share the local part %q, so this role cannot be restored unambiguously - grant it by hand after migrating",
+				p.Name, localPartCount[local], local))
+			continue
+		}
+		changes = append(changes, change{localPart: local, domain: domainOf(p), variant: variant, source: p.Name})
 	}
-	sort.Slice(changes, func(i, j int) bool { return changes[i].name < changes[j].name })
+	sort.Slice(changes, func(i, j int) bool { return changes[i].localPart < changes[j].localPart })
 
 	for _, c := range changes {
+		value := map[string]any{
+			// Account is a multi-variant object: without its own @type the
+			// upsert is rejected outright.
+			"@type": "User",
+			"name":  c.localPart,
+			"roles": map[string]any{"@type": c.variant},
+		}
 		ops = append(ops, Operation{
 			Type:    "upsert",
 			Object:  "Account",
 			MatchOn: []string{"name"},
-			Value: map[string]map[string]any{
-				"role-" + c.name: {
-					// Account is a multi-variant object: without its own
-					// @type the upsert is rejected outright.
-					"@type": "User",
-					"name":  c.name,
-					"roles": map[string]any{"@type": c.variant},
-				},
-			},
+			Value:   map[string]map[string]any{"role-" + c.localPart: value},
 		})
-		covered = append(covered, "principal:"+c.name+":roles")
+		covered = append(covered, "principal:"+c.source+":roles")
 	}
 	return ops, covered, warnings, nil
 }
 
+// localPart is the account name v0.16 will hold: the part before "@" when
+// the v0.15 principal is named by address, otherwise the name as-is.
+func localPart(p backup.Principal) string {
+	name := p.Name
+	if name == "" && len(p.Emails) > 0 {
+		name = p.Emails[0]
+	}
+	if at := strings.Index(name, "@"); at > 0 {
+		return name[:at]
+	}
+	return name
+}
+
+// domainOf reports the domain an account belongs to, for messages.
+func domainOf(p backup.Principal) string {
+	name := p.Name
+	if at := strings.Index(name, "@"); at > 0 && at+1 < len(name) {
+		return name[at+1:]
+	}
+	if len(p.Emails) > 0 {
+		if at := strings.Index(p.Emails[0], "@"); at > 0 && at+1 < len(p.Emails[0]) {
+			return p.Emails[0][at+1:]
+		}
+	}
+	return ""
+}
+
 // roleVariant maps a v0.15 role list onto v0.16's x:UserRoles variant.
 //
 // v0.15 carries a list of role names; v0.16 carries one variant. Where an