Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/infrastructure/auth0/identity.go`:
- Around line 129-137: The current error handling after apiRequest.Call(ctx,
&remainingIdentities) in identity.go returns a generic errors.NewUnexpected for
every failure; change this to preserve HTTP semantics by inspecting statusCode
and returning appropriate typed errors (e.g., errors.NewUnauthorized for 401,
errors.NewForbidden for 403, errors.NewNotFound for 404,
errors.NewBadRequest/validation error for 400/422) while still including errCall
as the underlying cause and logging via slog.ErrorContext (keep "user_id"
redaction and "error" details). Implement a switch or map on statusCode after
the call (referencing apiRequest.Call, statusCode, errCall, remainingIdentities,
primaryUserID) that returns the corresponding domain error instead of always
errors.NewUnexpected.
- Line 117: The URL is built by interpolating primaryUserID, provider, and
secondaryUserID directly (see the local variable url in identity.go), which can
contain reserved characters like '|' and break routing; update the construction
to percent-escape each path segment before formatting (e.g., call url.PathEscape
or equivalent on primaryUserID, provider, and secondaryUserID) and then build
the final string using ilf.domain and the escaped segments so the Auth0
Management API receives valid path segments.

In `@internal/infrastructure/auth0/user.go`:
- Around line 394-408: The validation currently uses equality checks against
empty string which allows whitespace-only values; update the validation in the
function handling the unlink request to trim and reject whitespace-only inputs
by using strings.TrimSpace on request.User.UserID, request.User.AuthToken,
request.Unlink.Provider, and request.Unlink.IdentityID and return the same
errors.NewValidation messages when TrimSpace(...) == "" so inputs like "   " are
treated as missing.

In `@pkg/redaction/redaction_test.go`:
- Around line 135-136: The test contains JWT-shaped string literals (jwt1 and
jwt2 in pkg/redaction/redaction_test.go) that trigger secret scanners; replace
those hard-coded token-looking constants with non-secret placeholders or
generate safe dummy tokens at runtime (e.g., build strings that do not match JWT
regex or use a helper like makeTestToken()) so the tests exercise redaction
logic without committing secret-like values; update references to jwt1 and jwt2
accordingly.

---

Outside diff comments:
In `@internal/service/message_handler.go`:
- Around line 408-412: LinkIdentity calls m.userReader.MetadataLookup(ctx,
linkRequest.User.AuthToken) without enforcing the identity-update scope; update
the MetadataLookup invocation in LinkIdentity to pass
constants.UserUpdateIdentityRequiredScope (alongside ctx and
linkRequest.User.AuthToken) so the lookup enforces the required authorization
scope, ensuring m.userReader.MetadataLookup receives the scope parameter and
returns metadata only when the token has UserUpdateIdentityRequiredScope.

---

Nitpick comments:
In `@internal/infrastructure/auth0/jwt_parser_test.go`:
- Line 78: Add a sibling unit test in jwt_parser_test.go that mirrors the
existing metadata-scope assertion but calls jwtVerify.JWTVerify(ctx, user.Token,
constants.UserUpdateIdentityRequiredScope) instead of
constants.UserUpdateMetadataRequiredScope, asserting the same expected behavior
(claims and error) to ensure the identity scope path is covered; locate the
existing test using jwtVerify.JWTVerify and
constants.UserUpdateMetadataRequiredScope and duplicate its structure, swapping
in constants.UserUpdateIdentityRequiredScope and updating assertions/messages
accordingly.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@internal/service/message_handler_test.go`:
- Around line 1160-1313: Add assertions in the tests that MetadataLookup is
invoked with the required scope by updating the
mockUserServiceReader.metadataLookupFunc implementations to check that their
input equals constants.UserUpdateIdentityRequiredScope; specifically, in the
cases "MetadataLookup failure", "unlinker error", "successful unlink passes
correct fields to unlinker", and "user_id is populated from MetadataLookup not
from payload" add something like if input !=
constants.UserUpdateIdentityRequiredScope { t.Fatalf(...) } before returning the
mocked (*model.User, error) so the tests validate the authorization contract;
reference the mockUserServiceReader.metadataLookupFunc and the constant
constants.UserUpdateIdentityRequiredScope when making the change.