Add displayName to auth response and configurable display name claim for OIDC

- Add displayName field to AuthTokenResponse so the UI shows human-readable
  names instead of internal JWT subjects (e.g. user:oidc:<hash>)
- Add displayNameClaim to OIDC config (default: "name") allowing admins to
  configure which ID token claim contains the user's display name
- Support dot-separated claim paths (e.g. profile.display_name) like rolesClaim
- Add admin UI field for Display Name Claim on the OIDC config page
- ClickHouse migration: ALTER TABLE adds display_name_claim column

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/api/schema.d.ts

@@ -522,6 +522,7 @@ export interface components {
             rolesClaim?: string;
             defaultRoles?: string[];
             autoSignup?: boolean;
+            displayNameClaim?: string;
         };
         /** @description Error response */
         ErrorResponse: {
@@ -537,6 +538,7 @@ export interface components {
             rolesClaim?: string;
             defaultRoles?: string[];
             autoSignup?: boolean;
+            displayNameClaim?: string;
         };
         SearchRequest: {
             status?: string;
@@ -592,6 +594,7 @@ export interface components {
         AuthTokenResponse: {
             accessToken: string;
             refreshToken: string;
+            displayName: string;
         };
         CallbackRequest: {
             code?: string;