Malformed identity payloads made ProviderSnapshot.normalize treat a provider
without any valid account identity as if it had one: the raw-item length
checks counted arrays and other discarded values, so the popup showed the
limits-unavailable message instead of no-usage. The placeholder now follows
the already-validated account, organization, and loginMethod strings, which
also keeps legacy usage.accountEmail providers eligible.

Regression coverage in tst_provider_snapshot covers malformed fields and the
legacy nested-identity path.