Link OAuth logins by provider user ID before matching email, refresh identity claims on login, and skip password confirmation for SSO-linked users.