Stop requesting the user email from the OIDC provider

OIDCConfig now asks for the openid and profile scopes only: kaya-oidc's
default would also request email, which the platform never stores or
exposes. The display-name fallback drops the email claim too
(preferred_username, name, then the sub).

Tests pin the configured scopes and cover an IdP that still returns an
email claim: the claim is ignored and absent from /api/me.

server/packages/tavolo-app/src/tavolo/app.py

@@ -203,6 +203,9 @@ oidc = OIDCProviders(
             redirect_uri=provider.redirect_uri,
             post_login_redirect=provider.post_login_redirect,
             post_logout_redirect=provider.post_logout_redirect,
+            # kaya-oidc defaults to openid+email+profile; the app neither
+            # needs nor stores the email claim (profile covers the names).
+            scopes=("openid", "profile"),
             fetch_userinfo=True,
         )
         for provider in settings.oidc_providers