Fix login accepting wrong credentials (empty user signed in anyway)

fis_admin_getUserAccount always inserted a result row, even when no
matching user was found, so fis_admin_authenticate never truly
returned "no result" on wrong credentials — the login handler then
signed the caller in with an empty useraccount_id. The authenticated
shell rendered (IsAuthenticated only checks the claim exists), while
every data endpoint 401'd (FuchsUserIdentity.IsAuthenticated also
checks the id is non-empty), producing an empty portal.

Also treat an empty useraccount_id in HandleLogin as a failed login
(defense in depth) and fix a column-name mismatch (auth vs
authorization) that was silently zeroing the authorization level.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Fuchs/Controllers/IntranetController.cs

@@ -249,16 +249,16 @@ public partial class IntranetController : Microsoft.AspNetCore.Mvc.Controller
         _logger.LogDebug("HandleLogin attempt for email={Email} ip={IP}",
             email, HttpContext.Connection.RemoteIpAddress);
         var row = await _intranet.AuthenticateAsync(email, password);
-        if (row == null)
+        string userId = row?.nz("useraccount_id") ?? "";
+        if (row == null || string.IsNullOrEmpty(userId))
         {
             _logger.LogWarning("Login failed for email={Email} ip={IP}",
                 email, HttpContext.Connection.RemoteIpAddress);
             return Unauthorized401();
         }
 
-        string userId = row.nz("useraccount_id");
         string userEmail = row.nz("email");
-        int auth = int.TryParse(row.nz("authorization"), out var a) ? a : 0;
+        int auth = int.TryParse(row.nz("auth"), out var a) ? a : 0;
 
         var identity  = FuchsUserIdentity.BuildIdentity(userId, userEmail, auth, Fuchs_intranet.AuthScheme);
         var principal = new System.Security.Claims.ClaimsPrincipal(identity);