fix: apply defaultRoles fallback when no claim mapping rules match

When no claim mapping rules are configured or none match the JWT
claims, fall back to assigning the OidcConfig.defaultRoles (e.g.
VIEWER). This restores the behavior that was lost when syncOidcRoles
was replaced with claim mapping.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-app/src/main/java/com/cameleer3/server/app/security/OidcAuthController.java

@@ -156,7 +156,7 @@ public class OidcAuthController {
                     userId, provider, oidcUser.email(), oidcUser.name(), Instant.now()));
 
             // Apply claim mapping rules to assign managed roles/groups from JWT claims
-            applyClaimMappings(userId, oidcUser.allClaims());
+            applyClaimMappings(userId, oidcUser.allClaims(), config.get());
 
             List<String> roles = rbacService.getSystemRoleNames(userId);
 
@@ -180,16 +180,14 @@ public class OidcAuthController {
         }
     }
 
-    private void applyClaimMappings(String userId, Map<String, Object> claims) {
+    private void applyClaimMappings(String userId, Map<String, Object> claims, OidcConfig oidcConfig) {
         List<ClaimMappingRule> rules = claimMappingRepository.findAll();
-        if (rules.isEmpty()) {
-            log.debug("No claim mapping rules configured, skipping for user {}", userId);
-            return;
-        }
 
         rbacService.clearManagedAssignments(userId);
 
-        List<ClaimMappingService.MappingResult> results = claimMappingService.evaluate(rules, claims);
+        List<ClaimMappingService.MappingResult> results = List.of();
+        if (!rules.isEmpty()) {
+            results = claimMappingService.evaluate(rules, claims);
             for (var result : results) {
                 ClaimMappingRule rule = result.rule();
                 switch (rule.action()) {
@@ -216,5 +214,20 @@ public class OidcAuthController {
             }
         }
 
+        // Fallback: if no mapping rules matched, assign defaultRoles from OIDC config
+        if (results.isEmpty()) {
+            List<String> defaultRoles = oidcConfig.defaultRoles();
+            if (defaultRoles != null && !defaultRoles.isEmpty()) {
+                for (String roleName : defaultRoles) {
+                    UUID roleId = SystemRole.BY_NAME.get(SystemRole.normalizeScope(roleName));
+                    if (roleId != null) {
+                        rbacService.assignRoleToUser(userId, roleId);
+                        log.debug("Default role {} assigned to {} (no claim mapping matched)", roleName, userId);
+                    }
+                }
+            }
+        }
+    }
+
     public record CallbackRequest(String code, String redirectUri) {}
 }