Stop requesting the user email from the OIDC provider

OIDCConfig now asks for the openid and profile scopes only: kaya-oidc's
default would also request email, which the platform never stores or
exposes. The display-name fallback drops the email claim too
(preferred_username, name, then the sub).

Tests pin the configured scopes and cover an IdP that still returns an
email claim: the claim is ignored and absent from /api/me.

server/packages/tavolo-app/src/tavolo/app.py

@@ -203,6 +203,9 @@ oidc = OIDCProviders(
             redirect_uri=provider.redirect_uri,
             post_login_redirect=provider.post_login_redirect,
             post_logout_redirect=provider.post_logout_redirect,
+            # kaya-oidc defaults to openid+email+profile; the app neither
+            # needs nor stores the email claim (profile covers the names).
+            scopes=("openid", "profile"),
             fetch_userinfo=True,
         )
         for provider in settings.oidc_providers

server/packages/tavolo-platform/src/tavolo/platform/auth.py

@@ -51,9 +51,9 @@ def display_name(user: OIDCUser) -> str:
 
     ``preferred_username`` is preferred: it is the account's stable handle,
     while ``name`` is a free-form display name a user may change (and two
-    accounts can share). ``email`` is a last resort before the ``sub``.
+    accounts can share). The ``sub`` is the last resort.
     """
-    for key in ("preferred_username", "name", "email"):
+    for key in ("preferred_username", "name"):
         value = user.get(key)
         if isinstance(value, str) and value:
             return value

server/packages/tavolo-platform/tests/test_auth.py

@@ -106,9 +106,11 @@ class DisplayNameTest(unittest.TestCase):
         user = OIDCUser({"sub": "alice", "name": "Alice"})
         self.assertEqual("Alice", display_name(user))
 
-    def test_falls_back_to_email(self) -> None:
+    def test_ignores_email(self) -> None:
+        # The app requests only the openid and profile scopes; an email
+        # claim the provider still returns must not leak into the name.
         user = OIDCUser({"sub": "alice", "email": "alice@example.com"})
-        self.assertEqual("alice@example.com", display_name(user))
+        self.assertEqual("alice", display_name(user))
 
     def test_falls_back_to_sub(self) -> None:
         user = OIDCUser({"sub": "alice"})