fix: ticketing identity lookup after BSON round trip + WeKan live test

- live testing against a real WeKan v9.36 found that the driver decodes
  nested extra.ticketingIdentities as bson.D, so identity lookups silently
  returned empty and consultants were skipped; handle bson.D/bson.M/map
- integration regression test pinning the BSON round trip
- opt-in live test (go test -tags=wekanlive) verifying TestConnection,
  FetchUpdated (assignee + member fallback), key listing, since-filter and
  unknown-identity rejection against a real instance

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/sync/manager_integration_test.go

@@ -201,6 +201,35 @@ func TestOrphanFlagging(t *testing.T) {
 	}
 }
 
+// TestTicketingIdentityBSONRoundTrip pins a live-found bug: the driver
+// decodes nested extra documents as bson.D (not map[string]any), which used
+// to make identity lookups silently return "".
+func TestTicketingIdentityBSONRoundTrip(t *testing.T) {
+	_, st, _, consultant := newSyncStack(t)
+	ctx := context.Background()
+
+	if _, err := st.DB.Collection("users").UpdateOne(ctx,
+		bson.M{"_id": consultant.ID},
+		bson.M{"$set": bson.M{"extra": bson.M{"ticketingIdentities": bson.M{
+			"jira": "cons@corp.example", "wekan": "cons-wekan",
+		}}}}); err != nil {
+		t.Fatal(err)
+	}
+	fresh, err := st.UserByID(ctx, consultant.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := ticketingIdentity(fresh, domain.TicketingJira); got != "cons@corp.example" {
+		t.Fatalf("jira identity after BSON round trip = %q", got)
+	}
+	if got := ticketingIdentity(fresh, domain.TicketingWekan); got != "cons-wekan" {
+		t.Fatalf("wekan identity after BSON round trip = %q", got)
+	}
+	if got := ticketingIdentity(fresh, domain.TicketingAzure); got != "" {
+		t.Fatalf("unset identity = %q, want empty", got)
+	}
+}
+
 func TestSyncSkipsConsultantWithoutIdentity(t *testing.T) {
 	_, st, customer, _ := newSyncStack(t)
 	ctx := context.Background()