Add displayName to auth response and configurable display name claim for OIDC

- Add displayName field to AuthTokenResponse so the UI shows human-readable
  names instead of internal JWT subjects (e.g. user:oidc:<hash>)
- Add displayNameClaim to OIDC config (default: "name") allowing admins to
  configure which ID token claim contains the user's display name
- Support dot-separated claim paths (e.g. profile.display_name) like rolesClaim
- Add admin UI field for Display Name Claim on the OIDC config page
- ClickHouse migration: ALTER TABLE adds display_name_claim column

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/pages/admin/OidcAdminPage.tsx

@@ -17,6 +17,7 @@ interface FormData {
   clientSecret: string;
   rolesClaim: string;
   defaultRoles: string[];
+  displayNameClaim: string;
 }
 
 const emptyForm: FormData = {
@@ -27,6 +28,7 @@ const emptyForm: FormData = {
   clientSecret: '',
   rolesClaim: 'realm_access.roles',
   defaultRoles: ['VIEWER'],
+  displayNameClaim: 'name',
 };
 
 export function OidcAdminPage() {
@@ -69,6 +71,7 @@ function OidcAdminForm() {
         clientSecret: '',
         rolesClaim: data.rolesClaim ?? 'realm_access.roles',
         defaultRoles: data.defaultRoles ?? ['VIEWER'],
+        displayNameClaim: data.displayNameClaim ?? 'name',
       });
       setSecretTouched(false);
     } else {
@@ -237,6 +240,20 @@ function OidcAdminForm() {
           </div>
         </div>
 
+        <div className={styles.field}>
+          <label className={styles.label}>Display Name Claim</label>
+          <input
+            className={styles.input}
+            type="text"
+            value={form.displayNameClaim}
+            onChange={(e) => updateField('displayNameClaim', e.target.value)}
+            placeholder="name"
+          />
+          <div className={styles.hint}>
+            Dot-separated path to the user's display name in the ID token (e.g. name, preferred_username, profile.display_name)
+          </div>
+        </div>
+
         <div className={styles.field}>
           <label className={styles.label}>Default Roles</label>
           <div className={styles.tags}>