Stop requesting the user email from the OIDC provider

OIDCConfig now asks for the openid and profile scopes only: kaya-oidc's
default would also request email, which the platform never stores or
exposes. The display-name fallback drops the email claim too
(preferred_username, name, then the sub).

Tests pin the configured scopes and cover an IdP that still returns an
email claim: the claim is ignored and absent from /api/me.

server/tests/test_routes_auth.py

@@ -10,7 +10,7 @@ import unittest
 
 from httpx import ASGITransport, AsyncClient
 
-from tavolo.app import app
+from tavolo.app import app, oidc
 from tests.helpers import async_test
 
 
@@ -33,3 +33,10 @@ class AuthRoutesTest(unittest.TestCase):
             response = await client.get("/auth/login", follow_redirects=False)
         self.assertEqual(302, response.status_code)
         self.assertEqual("/auth/default/login", response.headers["location"])
+
+    def test_authorization_scopes_exclude_email(self) -> None:
+        # Only the scopes the app uses are requested: openid (sub) and
+        # profile (preferred_username/name). kaya-oidc's default would also
+        # request email, which the app neither needs nor stores.
+        mixin = oidc.provider("default")
+        self.assertEqual(("openid", "profile"), tuple(mixin._config.scopes))