Re-link and reactivate accounts from the admin #67

Today, when Re-link Protection refuses a link, an admin fixes it from the server with wp workos user link <id> <workos_id> --force (or --reactivate for deactivated accounts, #55). Support teams without shell access can't do it.

Fix

• On the user-edit screen's "Re-link refused" notice, add a "Move this account to the new WorkOS user" action.
• The action:
  • shows both WorkOS users (email, created date, last sign-in);
  • asks for confirmation;
  • runs the same code path as the CLI, including reactivation when needed.
• Gated by edit_users (or the plugin capability from Plugin capabilities for WorkOS user management #65).
• Logged with who did it and both WorkOS IDs.

Done when

• Tests cover the endpoint and capability.
• Both the active and the deactivated cases match the CLI.