AMA: link bookings to signed-in accounts

[CaliCastle]

Goal

Let a signed-in public user associate AMA Bookings with their Clerk account and later view or manage those bookings from an account surface.

Context

This is intentionally deferred. The first AMA release keeps bookings accountless and uses private Manage Links. Public Clerk signup and admin authorization remain separate concerns, and admin access is granted only through the server-side owner allowlist.

The future account feature should preserve guest booking rather than making account creation a requirement.

Security and privacy constraints

• Store Clerk's immutable user ID as the account association; do not authorize ownership by email alone.
• Require explicit proof of control before attaching an existing Booking to an account.
• Keep Manage Links revocable and safe if a Booking becomes account-linked.
• Prevent account linking, email changes, or account recovery from transferring a Booking unintentionally.
• Define unlinking, account deletion, and compromised-account recovery behavior.
• Apply the AMA retention policy independently of whether a Booking is account-linked.
• Never expose one guest's Booking Brief, contact information, payment metadata, or meeting details to another account.

Decisions still needed

• How a user proves ownership of an existing Booking.
• Whether future Bookings link automatically after explicit consent.
• Whether one Booking may be visible to more than one account.
• How historical Bookings, changed email addresses, unlinking, and account deletion behave.
• Whether account access replaces or supplements Manage Links.

Dependency

Design and ship the accountless Manage Link lifecycle in #85 first. This issue should receive a separate threat-model review before it becomes ready-for-agent.