fix(auth): extract preferred_username from JWT instead of sub (UUID)

src/core/auth/oidc.go

@@ -196,16 +196,22 @@ func decodeJWTSub(token string) (string, error) {
 
 	var claims struct {
 		Sub               string `json:"sub"`
+		PreferredUsername string `json:"preferred_username"`
 	}
 	if err := json.Unmarshal(payload, &claims); err != nil {
 		return "", fmt.Errorf("parse JWT claims: %w", err)
 	}
 
-	if claims.Sub == "" {
+	// Use preferred_username (actual username), fall back to sub (UUID)
-		return "", fmt.Errorf("missing sub claim in id_token")
+	username := claims.PreferredUsername
+	if username == "" {
+		username = claims.Sub
+	}
+	if username == "" {
+		return "", fmt.Errorf("missing username in id_token")
 	}
 
-	return claims.Sub, nil
+	return username, nil
 }
 
 // pkceChallenge creates a PKCE S256 challenge from a verifier.