feat: add Kanidm OIDC support with PKCE and ID token algo config

[mikimandoki]

Description

While I was attempting to set up Kanidm to work with SplitPro I had hit a few roadblocks:

1. Kanidm includes an issued_token_type field in its token response which isn't in the Prisma schema, causing a DB crash before the account could be created. Rather than adding another provider-specific case to linkAccount, this PR replaces the entire chain with a generic sanitisation pass using Prisma.AccountScalarFieldEnum as the source of truth. Any provider with non-standard fields now works without further changes.

2. Kanidm also enforces PKCE and ES256 by default, both of which were previously not supported by SplitPro. These can now be configured by optional env vars. I also added an example kanidm env config.

To test these changes, I ran the updated code on my NAS in a Docker container and finally managed to authenticate with Kanidm. Disabling PKCE or defaulting to RS256 both fail on the default Kanidm config.

Checklist

• I have read CONTRIBUTING.md in its entirety
• I have performed a self-review of my own code
• I have added unit tests to cover my changes
• The last commit successfully passed pre-commit checks
• Any AI code was thoroughly reviewed by me