OIDCConfig now asks for the openid and profile scopes only: kaya-oidc's
default would also request email, which the platform never stores or
exposes. The display-name fallback drops the email claim too
(preferred_username, name, then the sub).
Tests pin the configured scopes and cover an IdP that still returns an
email claim: the claim is ignored and absent from /api/me.