Stop requesting the user email from the OIDC provider

OIDCConfig now asks for the openid and profile scopes only: kaya-oidc's
default would also request email, which the platform never stores or
exposes. The display-name fallback drops the email claim too
(preferred_username, name, then the sub).

Tests pin the configured scopes and cover an IdP that still returns an
email claim: the claim is ignored and absent from /api/me.

server/tests/helpers/oidc.py

@@ -23,14 +23,26 @@ from tavolo.platform import auth
 _PROVIDER = next(iter(oidc.providers))
 
 
-def make_user(sub: str, name: Optional[str] = None) -> OIDCUser:
-    return OIDCUser({"sub": sub, "preferred_username": name or sub})
+def make_user(
+    sub: str, name: Optional[str] = None, email: Optional[str] = None
+) -> OIDCUser:
+    claims = {"sub": sub, "preferred_username": name or sub}
+    if email:
+        claims["email"] = email
+    return OIDCUser(claims)
 
 
 @contextlib.contextmanager
-def oidc_user(sub: str, name: Optional[str] = None) -> Iterator[OIDCUser]:
-    """Context manager: make ``oidc.get_users`` return this user."""
-    user = make_user(sub, name)
+def oidc_user(
+    sub: str, name: Optional[str] = None, email: Optional[str] = None
+) -> Iterator[OIDCUser]:
+    """Context manager: make ``oidc.get_users`` return this user.
+
+    ``email`` is optional so tests can simulate an IdP that still returns
+    the claim: the app requests only the ``openid`` and ``profile`` scopes
+    and ignores email where present.
+    """
+    user = make_user(sub, name, email)
     patcher = _mock.patch.object(oidc, "get_users", return_value={_PROVIDER: user})
     patcher.start()
     try: