fix: ticketing identity lookup after BSON round trip + WeKan live test

- live testing against a real WeKan v9.36 found that the driver decodes
  nested extra.ticketingIdentities as bson.D, so identity lookups silently
  returned empty and consultants were skipped; handle bson.D/bson.M/map
- integration regression test pinning the BSON round trip
- opt-in live test (go test -tags=wekanlive) verifying TestConnection,
  FetchUpdated (assignee + member fallback), key listing, since-filter and
  unknown-identity rejection against a real instance

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/sync/manager.go

@@ -10,6 +10,8 @@ import (
 	"sync"
 	"time"
 
+	"go.mongodb.org/mongo-driver/v2/bson"
+
 	"bountyboard/internal/domain"
 	"bountyboard/internal/files"
 	"bountyboard/internal/metrics"
@@ -287,12 +289,24 @@ func ticketingIdentity(u *domain.User, t domain.TicketingType) string {
 	if t == domain.TicketingDemo {
 		return u.Email // demo accepts any identity
 	}
-	ids, _ := u.Extra["ticketingIdentities"].(map[string]any)
-	if ids == nil {
-		return ""
+	// The driver decodes the nested document as bson.D when the field type
+	// is `any`; JSON-built values arrive as map[string]any. Handle both.
+	switch ids := u.Extra["ticketingIdentities"].(type) {
+	case map[string]any:
+		v, _ := ids[string(t)].(string)
+		return v
+	case bson.M:
+		v, _ := ids[string(t)].(string)
+		return v
+	case bson.D:
+		for _, e := range ids {
+			if e.Key == string(t) {
+				v, _ := e.Value.(string)
+				return v
+			}
+		}
 	}
-	v, _ := ids[string(t)].(string)
-	return v
+	return ""
 }
 
 func contentHash(t Ticket) string {