fix(users): default the email of users declared only in the inventory

oauth2-proxy rejected biber in CI run 35674334334 ("biber@infinito.test
[AuthFailure] unauthorized") after the CI domain moved to
main.infinito.test: the development inventory hardcoded biber's address to
infinito.test while email_domains follows DOMAIN_PRIMARY. The checkmk,
funkwhale, openproject and jitsi jobs failed on it.

Dropping the hardcoded address alone left biber without any email, since
only users declared in a role's meta/users.yml receive the
<username>@{{ DOMAIN_PRIMARY }} default; the OpenLDAP users task then
failed on "object of type 'dict' has no attribute 'email'".
_apply_account_defaults now gives inventory-only users the same default,
and an explicit email still wins.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/utils/cache/users/test_module.py

@@ -225,9 +225,16 @@ class TestMergeUsers(unittest.TestCase):
             {
                 "invuser": {"username": "invuser"},
                 "invbot": {"username": "invbot", "roles": ["bot"]},
-                "pinned": {"username": "pinned", "accounts": [], "forward": "x"},
+                "pinned": {
+                    "username": "pinned",
+                    "accounts": [],
+                    "forward": "x",
+                    "email": "pinned@example.org",
+                },
             }
         )
+        self.assertEqual(merged["invuser"]["email"], "invuser@{{ DOMAIN_PRIMARY }}")
+        self.assertEqual(merged["pinned"]["email"], "pinned@example.org")
         self.assertEqual(merged["invuser"]["accounts"], ["identity"])
         self.assertEqual(merged["invuser"]["forward"], "")
         self.assertEqual(merged["invbot"]["accounts"], ["mailbox", "identity"])