Identity resolver: case-insensitive matching at Tier 1

normalizeEmployeeId trims, strips domain, and strips leading zeros, but leaves case untouched, and Tier 1 matches employee_id exactly and case-sensitively. On qa, 39 of 51 corporate rows carry lowercase nickname employee ids, so a differently-cased SSO claim misses Tier 1 and falls through to Tier 1b, which compares on a lowered value. No lockouts today because Tier 1b catches every case, including the 7 rows with no federated_alias. This is tier degradation rather than an access failure. Fix is to lower-case within normalizeEmployeeId or add a lowered candidate to employeeIdCandidates, applied to both the TS module and the sidecar JS copy in server/alb-identity/claims.js. Source: verification of PR 189, Aug 16 2026.