Attempt to fix OIDC with external IDP configuration

Added missing OIDC configuration for external authentication:
- Excluded internal IDP service (OC_EXCLUDE_RUN_SERVICES: idp,search)
- Added OC_OIDC_CLIENT_SCOPES
- Added IDP_DOMAIN for CSP rules
- Changed PROXY_USER_OIDC_CLAIM to email

Issue: OpenCloud still shows internal login page. Root cause appears
to be architectural - OpenCloud requires either:
1. Internal IDP + Internal IDM (default)
2. External LDAP + External OIDC (external-idp mode)

Pure external OIDC without LDAP backend may not be supported.
Next steps: Consider deploying OpenLDAP or using internal IDP.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/opencloud/opencloud-deployment.yaml

@@ -91,9 +91,9 @@ spec:
         - name: PROXY_TLS
           value: "false"
 
-        # Exclude broken search service (GitHub issue #1740)
+        # Exclude broken search service + internal IDP (using Pocket ID)
         - name: OC_EXCLUDE_RUN_SERVICES
-          value: "search"
+          value: "idp,search"
 
         # Data paths
         - name: OPENCLOUD_BASE_DATA_PATH
@@ -151,10 +151,12 @@ spec:
             secretKeyRef:
               name: opencloud-oidc-secret
               key: oidc-client-secret
+        - name: OC_OIDC_CLIENT_SCOPES
+          value: "openid profile email groups offline_access"
         - name: PROXY_OIDC_REWRITE_WELLKNOWN
           value: "true"
         - name: PROXY_USER_OIDC_CLAIM
-          value: "preferred_username"
+          value: "email"
         - name: PROXY_USER_CS3_CLAIM
           value: "username"
         - name: PROXY_AUTOPROVISION_ACCOUNTS
@@ -163,6 +165,8 @@ spec:
           value: "oidc"
         - name: PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM
           value: "groups"
+        - name: IDP_DOMAIN
+          value: "auth.basicstack.de"
 
         # SMTP Configuration
         - name: NOTIFICATIONS_SMTP_HOST