Auth: the custom-token account lookup does not copy verification, phone and provider fields #78

From the Copilot review of #73 (#73 (comment)), on the custom-token lookup from #71 by @KadirJeager.

The verifyCustomToken response carries no verification, phone or provider information, so the initial user has isEmailVerified = false, no phone number and no providers. updateByGetAccountInfo now reads the profile from users[0] but copies only createdAt, email, photoUrl and displayName, so a verified or linked account signed in with a custom token keeps those incorrect values, and they are persisted.

Suggested fix: also copy emailVerified, phoneNumber and providerUserInfo from the lookup profile into the user, with a test using a lookup response that carries them.