Fix OIDC email: load Authelia profile from UserInfo

Auth.js OIDC only reads ID-token claims by default; Authelia puts
email on UserInfo. Set idToken:false, harden claim extraction, and
document an optional Authelia claims_policy.

src/lib/auth/oidc.ts

@@ -5,3 +5,23 @@ export function isOidcConfigured(): boolean {
       process.env.AUTH_OIDC_CLIENT_SECRET?.trim()
   );
 }
+
+/** Pull an email out of common OIDC claim shapes (Authelia, Keycloak, etc.). */
+export function emailFromOidcProfile(
+  profile: Record<string, unknown>
+): string | null {
+  const candidates = [
+    profile.email,
+    profile.preferred_username,
+    profile.upn,
+    profile.mail,
+    (profile.user as { email?: unknown } | undefined)?.email,
+  ];
+
+  for (const value of candidates) {
+    if (typeof value !== "string") continue;
+    const trimmed = value.trim();
+    if (trimmed.includes("@")) return trimmed.toLowerCase();
+  }
+  return null;
+}