Add displayName to auth response and configurable display name claim for OIDC

- Add displayName field to AuthTokenResponse so the UI shows human-readable
  names instead of internal JWT subjects (e.g. user:oidc:<hash>)
- Add displayNameClaim to OIDC config (default: "name") allowing admins to
  configure which ID token claim contains the user's display name
- Support dot-separated claim paths (e.g. profile.display_name) like rolesClaim
- Add admin UI field for Display Name Claim on the OIDC config page
- ClickHouse migration: ALTER TABLE adds display_name_claim column

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-app/src/main/java/com/cameleer3/server/app/dto/AuthTokenResponse.java

@@ -6,5 +6,6 @@ import jakarta.validation.constraints.NotNull;
 @Schema(description = "JWT token pair")
 public record AuthTokenResponse(
         @NotNull String accessToken,
-        @NotNull String refreshToken
+        @NotNull String refreshToken,
+        @NotNull String displayName
 ) {}

cameleer3-server-app/src/main/java/com/cameleer3/server/app/dto/OidcAdminConfigRequest.java

@@ -12,5 +12,6 @@ public record OidcAdminConfigRequest(
         String clientSecret,
         String rolesClaim,
         List<String> defaultRoles,
-        boolean autoSignup
+        boolean autoSignup,
+        String displayNameClaim
 ) {}

cameleer3-server-app/src/main/java/com/cameleer3/server/app/dto/OidcAdminConfigResponse.java

@@ -15,17 +15,18 @@ public record OidcAdminConfigResponse(
         boolean clientSecretSet,
         String rolesClaim,
         List<String> defaultRoles,
-        boolean autoSignup
+        boolean autoSignup,
+        String displayNameClaim
 ) {
     public static OidcAdminConfigResponse unconfigured() {
-        return new OidcAdminConfigResponse(false, false, null, null, false, null, null, false);
+        return new OidcAdminConfigResponse(false, false, null, null, false, null, null, false, null);
     }
 
     public static OidcAdminConfigResponse from(OidcConfig config) {
         return new OidcAdminConfigResponse(
                 true, config.enabled(), config.issuerUri(), config.clientId(),
                 !config.clientSecret().isBlank(), config.rolesClaim(),
-                config.defaultRoles(), config.autoSignup()
+                config.defaultRoles(), config.autoSignup(), config.displayNameClaim()
         );
     }
 }