Add displayName to auth response and configurable display name claim for OIDC

- Add displayName field to AuthTokenResponse so the UI shows human-readable
  names instead of internal JWT subjects (e.g. user:oidc:<hash>)
- Add displayNameClaim to OIDC config (default: "name") allowing admins to
  configure which ID token claim contains the user's display name
- Support dot-separated claim paths (e.g. profile.display_name) like rolesClaim
- Add admin UI field for Display Name Claim on the OIDC config page
- ClickHouse migration: ALTER TABLE adds display_name_claim column

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/api/openapi.json

@@ -1393,6 +1393,9 @@
           },
           "autoSignup": {
             "type": "boolean"
+          },
+          "displayNameClaim": {
+            "type": "string"
           }
         }
       },
@@ -1438,6 +1441,9 @@
           },
           "autoSignup": {
             "type": "boolean"
+          },
+          "displayNameClaim": {
+            "type": "string"
           }
         }
       },
@@ -1593,11 +1599,15 @@
           },
           "refreshToken": {
             "type": "string"
+          },
+          "displayName": {
+            "type": "string"
           }
         },
         "required": [
           "accessToken",
-          "refreshToken"
+          "refreshToken",
+          "displayName"
         ]
       },
       "CallbackRequest": {