fix: use NES user id for cli amplitude events

[facundo-herodevs]

Summary

This PR updates CLI analytics so Amplitude uses the NES user ID as the canonical user_id, matching the identifier used downstream by eol-api.

Changes

• Updated CLI analytics identity resolution to use nes.identity from the JWT instead of relying on sub.
• Normalized nes.identity so it works whether the claim is returned as a string or number.
• Kept the existing behavior of not falling back to sub when nes.identity is missing.
• Simplified the analytics identity flow in analytics.svc.ts by removing unnecessary intermediate mapping.
• Removed the temporary auth_sub handling from the CLI after confirming the real access token used by the CLI does not include a sub claim.

Result

• Amplitude events emitted by the CLI now use the same canonical user identifier as eol-api.
• CLI analytics no longer depend on Keycloak sub for user identification.
• The implementation is smaller and more explicit about the source of truth for user_id.

https://github.com/neverendingsupport/data-and-integrations/issues/664