fix(runtime): SSO handoff value must be unique (embed token)

The cloud-minted SSO handoff (`sso_as_owner` / 'Open' button) writes a
`sys_verification` row whose unique token lives in `identifier`
(`sso-handoff:<token>`) while `value` held a static JSON payload
{email,name,by,envId}. But `sys_verification.value` carries a UNIQUE index
(it is the OTP/token column for email-verification flows), so opening the
SAME environment twice as the same owner produced identical value JSON and
the second issuance failed with:
  UNIQUE constraint failed: sys_verification.value
i.e. an operator opening their env a second time got a 500.

Embed the unique handoff token (`t`) in the value payload so each issuance
is distinct. The sso-exchange consumer only reads email/name, so the extra
field is inert.

Author: os-zhuang

packages/runtime/src/cloud/auth-proxy-plugin.ts

@@ -257,7 +257,14 @@ export class AuthProxyPlugin implements Plugin {
                             const expiresAt = new Date(Date.now() + ttlSec * 1000);
                             await internal.createVerificationValue({
                                 identifier: `sso-handoff:${handoff}`,
-                                value: JSON.stringify({ email, name, by, envId: envIdInBody ?? environmentId }),
+                                // `sys_verification.value` carries a UNIQUE index (it is the
+                                // OTP/token column for email-verification flows). The handoff
+                                // puts its unique token in `identifier`, so the value payload
+                                // must ALSO embed the token (`t`) — otherwise two handoffs for
+                                // the same owner+env produce identical value JSON and the second
+                                // one fails with `UNIQUE constraint failed: sys_verification.value`
+                                // (i.e. opening the same environment twice 500s).
+                                value: JSON.stringify({ email, name, by, envId: envIdInBody ?? environmentId, t: handoff }),
                                 expiresAt,
                             });
                             return c.json({