fix: re-evaluate OIDC role claim on every login and support array values

[ImperatorRuscal]

Description

Previously the OIDC role claim (recommended: immich_role) was only read at user auto-registration time and only accepted as a scalar string, so admin status never updated after the first login and array-valued role/group claims (common with Azure AD/Entra ID, along with may other IdPs) were silently ignored.

Now the role claim is normalized from either a string or an array of strings, and existing users have their isAdmin flag synced from the claim on every login, keeping the IdP as the source of truth for privileges while leaving isAdmin untouched when the claim is blank.

How Has This Been Tested?

• User/Pass auth works as before
• OIDC works with a scalar string value for the RoleClaim (as before)
• OIDC works with an array of strings in the RoleClaim ("roles": ["admin","user"]) detects admin (This used a standard Entra ID application role assignment w/o claims mappings for the testing)
• OIDC is evaluated at each login (an existing user has the value of isAdmin updated based on the presence of the admin RoleClaim
• OIDC defaults to user in the event RoleClaim doesn't contain admin, regardless of the presence of the user value (it defaults safe to user, even on malformed or null claim results)

Screenshots (if appropriate)

No visible/UI changes, all server processing of OIDC auth

API Changes

No API changes in the PR

Checklist:

• I have carefully read CONTRIBUTING.md
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation if applicable
• I have no unrelated changes in the PR.
• I have confirmed that any new dependencies are strictly necessary.
• I have written tests for new code (if applicable)
• I have followed naming conventions/patterns in the surrounding code
• All code in src/services/ uses repositories implementations for database calls, filesystem operations, etc.
• All code in src/repositories/ is pretty basic/simple and does not have any immich specific logic (that belongs in src/services/)
  • No changes to src/repositories/

Please describe to which degree, if any, an LLM was used in creating this pull request.

Coding performed by a human. An internal Code Review was performed with Claude Sonnet 5.

[immich-push-o-matic]

Label error. Requires exactly 1 of: changelog:.*. Found: 🗄️server. A maintainer will add the required label.