[R1-04] Verify and finish ORCID author evidence

[dkritarth]

Outcome

Show correct ORCID links when trustworthy metadata exists; never attach wrong identity to author.

Dependencies

Blocked by #31. Existing PR #24 is stacked on PR #23 and must remain ordered.

Scope

Review PR #24 after earlier stack lands. Validate Crossref parsing, positional alignment safety, schema migration, rendering, external-link handling, accessibility, and graceful absence.

Acceptance criteria

• Valid ORCID normalizes and round-trips through storage.
• Badge is attached only to matching author.
• Divergent agent/Crossref author lists drop uncertain ORCIDs.
• Missing/malformed ORCID renders plain author text.
• Link targets canonical HTTPS ORCID profile with safe external behavior.
• Old database rows load without migration regression.
• Real DOI with known ORCID is verified against Crossref and profile.
• arXiv/no-ORCID paper remains clean.

Live verification

Ingest one DOI with ORCID and one paper without. Compare displayed author/ORCID to Crossref response and ORCID page; restart app and recheck.

Required PR evidence

PR must use Closes #32, stay focused, and include:

• regression/failing test or reproducible baseline;
• focused tests plus npm test, npm run typecheck, npm run build, git diff --check;
• exact Electron clicks/typing and observed result;
• screenshots for UI changes when tooling permits;
• console output, restart/persistence result, and unresolved limitations;
• real-paper evidence for reader behavior.

Existing PR code and mocked tests are not sufficient. Reviewer must independently exercise live flow before merge.