The OIDC user login ID is now configurable via the admin OIDC setup dialog (userIdClaim field). Supports dot-separated claim paths (e.g. 'email', 'preferred_username', 'custom.user_id'). Defaults to 'sub' for backwards compatibility. Throws if the configured claim is missing from the id_token. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>