docs(qa): revise eighteen identity-auth checklist items the wave run found stale

Each item gains a history row naming the card. The mail-capture items read
the token from the sys_email row; the sign-up gates say which address
proves which door; the two-factor, session, org, linked-account, SSO,
auth-method and OAuth items name the surfaces and oracles the slice
measured.

Claude-Session: https://claude.ai/code/session_016PVjjuVPte5XEJvaQx1E4t
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude