Auth.js OIDC only reads ID-token claims by default; Authelia puts email on UserInfo. Set idToken:false, harden claim extraction, and document an optional Authelia claims_policy.
