feat(oidc): permit auto/manual oidc account link/unlink

link are checking that email matches, +email alias are normalize into email
if email is already used on another account, link is not possible
not usurpation risk as the IDP is choosen by the admin

example.env

@@ -608,6 +608,17 @@ OXICLOUD_OIDC_ENABLED=false
 # Auto-create users on first OIDC login (JIT provisioning) (default: true)
 #OXICLOUD_OIDC_AUTO_PROVISION=true
 
+# Auto-link an existing local user to their OIDC identity when the
+# subject-lookup misses BUT the IdP-returned email (verified=true)
+# matches a local account. Great UX for users who already had a
+# password account when SSO gets enabled — first "Sign in with SSO"
+# just works, no admin round-trip. Requires email_verified=true from
+# the IdP; refuses on ambiguity (>1 local user normalises to the same
+# email) and when the matched user is already linked to a different
+# identity. See docs/plan/oidc-account-linking.md for the full
+# decision tree. Default: true.
+#OXICLOUD_OIDC_AUTO_LINK_EMAIL_MATCH=true
+
 # Comma-separated list of OIDC groups that grant admin role
 # Example: admins,cloud-admins
 #OXICLOUD_OIDC_ADMIN_GROUPS=