docs: OIDC UserInfo claims and identity-based account matching

[gantoine]

Documents two OIDC login changes in rommapp/romm:

• fix(oidc): fetch claims missing from the ID token from the UserInfo endpoint romm#4893: claims the ID token leaves out (email, email_verified, the username attribute, the role claim) are fetched from the provider's UserInfo endpoint.
• fix(auth): match OIDC users by their sub claim so an email change still logs in romm#4892: after the first email match, an account is linked to the provider's iss and sub. Email changes at the provider carry over, a new issuer relinks by email, and a different subject for an already linked email at the same issuer is refused with a 403.

Changes:

• OIDC Setup: "How it works" mentions the UserInfo fallback; new Account matching section; the "Email must match" note and the role-claim hints now cover the UserInfo response.
• Authentication Troubleshooting: the role-claim check covers UserInfo, "Email is missing from token" is no longer Zitadel-only, and a new entry covers the 403 with the SQL to clear a stale link.
• Zitadel and Authelia guides: the lines that said email is the only link between accounts.

Hold this until both romm PRs merge (#4892 is stacked on #4893).

trunk check is clean. mkdocs build --strict shows only the local cairosvg social-card warning.

AI assistance: written by Claude Code, with the maintainer reviewing.

🤖 Generated with Claude Code