fix(user): match profile validation hook argument type

Accept the stdClass user data passed by WordPress and derive the user ID only from the hook object. Cover callback registration, nonce and permission guards, and mismatched posted IDs; refresh the identity review dialog contract.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/widget-system/user-features-contract.test.cjs

@@ -200,6 +200,7 @@ test('native user profile omits ledger tables and renders canonical images eager
 test('identity marker and profile are editable on the native profile while applications use the review queue', () => {
   const auth = read('src/User/AuthApply.php');
   const verify = read('src/Admin/Native/UsersMenusVerify.php');
+  const verifyDialogs = read('src/Admin/Native/UsersMenusVerifyDialogs.php');
   const transitions = read('src/Identity/TransitionService.php');
 
   assert.match(auth, /add_action\('edit_user_profile_update', \[\$this, 'save_admin_profile'\]\)/);
@@ -214,9 +215,11 @@ test('identity marker and profile are editable on the native profile while appli
   assert.doesNotMatch(auth, /name="aksrt_identity_(?:application_uuid|type|status|public_name)"/);
 
   assert.match(verify, /'general',[\s\S]*?'manual'/);
-  assert.match(verify, /if \(\$status === 'manual_pending'\)/);
-  assert.match(verify, /'verified' => __\('通过申请'/);
-  assert.match(verify, /'rejected' => __\('拒绝申请'/);
+  assert.match(verify, /use UsersMenusVerifyDialogs;/);
+  assert.match(verifyDialogs, /\$pending = \$row\['status'\] === 'manual_pending'/);
+  assert.match(verifyDialogs, /if \(\$pending\) \{\s*echo '<form[^\n]*data-aksrt-verify-review>/);
+  assert.match(verifyDialogs, /'verified' => __\('通过申请'/);
+  assert.match(verifyDialogs, /'rejected' => __\('拒绝申请'/);
   assert.match(verify, /AuthApply::review\(\$user_id, \$uuid, \$status, \$note, get_current_user_id\(\), \$fields\)/);
   assert.match(auth, /\['verified', 'rejected'\]/);
   assert.match(auth, /\(string\) \$application\['status'\] !== 'manual_pending'/);