Fix OIDC email: load Authelia profile from UserInfo

Auth.js OIDC only reads ID-token claims by default; Authelia puts
email on UserInfo. Set idToken:false, harden claim extraction, and
document an optional Authelia claims_policy.

tests/unit/oidc-email.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from "vitest";
+import { emailFromOidcProfile } from "@/lib/auth/oidc";
+
+describe("emailFromOidcProfile", () => {
+  it("reads email claim", () => {
+    expect(emailFromOidcProfile({ email: "[email protected]" })).toBe(
+      "[email protected]"
+    );
+  });
+
+  it("falls back to preferred_username when it looks like an email", () => {
+    expect(
+      emailFromOidcProfile({ preferred_username: "[email protected]" })
+    ).toBe("[email protected]");
+  });
+
+  it("ignores non-email preferred_username", () => {
+    expect(emailFromOidcProfile({ preferred_username: "nick" })).toBeNull();
+  });
+
+  it("returns null when nothing usable is present", () => {
+    expect(emailFromOidcProfile({ sub: "abc", name: "Nick" })).toBeNull();
+  });
+});