Add email_verified check for OIDC login

- Parse email_verified from ID token and UserInfo endpoint
- Reject OIDC login if email is present and not verified
- Only applies when email is in OIDC claims (not required otherwise)

src/application/ports/auth_ports.rs

@@ -140,6 +140,7 @@ pub struct OidcTokenSet {
 pub struct OidcIdClaims {
     pub sub: String,
     pub email: Option<String>,
+    pub email_verified: Option<bool>,
     pub preferred_username: Option<String>,
     pub name: Option<String>,
     pub groups: Vec<String>,