chore: correct in docs what the userinfo email claim identifies

.env

@@ -56,8 +56,12 @@ MAILER_DSN=null://null
 # https://ephub.ddev.site/auth/check for local dev, plus the production host. Leave the id and
 # secret empty until then -- the login page detects it and says so.
 #
-# `email` is the identity claim. Do NOT use profile.communication.email: it comes from the CRM
-# address record and is not necessarily the login email.
+# `email` is the address the account actually signed in with, and it is what the local `user`
+# table is keyed on. It is not myep's account identifier -- that is the opaque, stable `sub`
+# claim, which myep's consumer guide asks consumers to match on. Keying on email here is
+# deliberate, at the price of a myep-side email change reading as a new account, so such a
+# change has to be applied to the `user` table too. Do NOT use profile.communication.email: it
+# is the first contact address on the BusPro record, shared by every account of the same person.
 EP_OAUTH2_CLIENT_ID=
 EP_OAUTH2_CLIENT_SECRET=
 EP_OAUTH2_URL_AUTHORIZE=https://myep.ddev.site/authorize