`post_authentication` overwrites stored email with empty string

[dmeiser]

Synthesized from full-repo review (KW-REVIEW-SYNTHESIS).

• Severity: Medium
• Location: src/handlers/post_authentication.py:83-94
• Summary: If user_attributes lacks email (phone-only or some social signups), the handler writes email = "", clobbering a previously stored address.
• Recommendation: Only update email when a non-empty value is present.
• Source reviews: deepseek-v4-pro