feat: OIDC role mapping

[RogerHYang]

resolves #9481
resolves #9888

---

Note

Adds OIDC role-to-Phoenix role mapping (ADMIN/MEMBER/VIEWER) via env-configured claim path and strict mode, applying/syncing roles on login with extensive tests.

• Auth/OIDC:
  • Introduce OAuth2UserRoleName (ADMIN|MEMBER|VIEWER) and reject SYSTEM for OAuth2.
  • Add env-driven role mapping config: ROLE_ATTRIBUTE_PATH, ROLE_MAPPING, ROLE_ATTRIBUTE_STRICT in OAuth2ClientConfig.from_env with robust validation.
  • Update OAuth2Client to extract role via JMESPath, map/validate roles, and honor strict/non-strict behavior; extend has_sufficient_claims to consider roles.
  • Enhance login flow (oauth2.py): validate ID token errors, validate access, extract/map role, and assign/sync role on sign-in/create (preserve role when mapping disabled).
• Testing:
  • Add comprehensive unit/integration tests for role mapping, strict mode, groups interplay, and claim sufficiency; refactor OIDC integration tests into tests/integration/auth/test_oidc.py.
  • Extend mock OIDC server/fixtures to emit role claims and new env cases.

^{Written by Cursor Bugbot for commit a7e7a51. This will update automatically on new commits. Configure here.}