Reject corrupted identity metadata from browser storage

## Problem Browser storage parsing accepts zero, negative, and fractional user IDs, and interprets every non-true admin value as false. Corrupted storage can therefore create a plausible but invalid local identity. ## Expected behavior Accept only positive safe-integer IDs and only the literal true/false permission values; otherwise return unknown metadata. ## Verification Add an auth storage regression test with malformed ID and admin values.