OIDC provider template drops `claims_source` (generic providers against Okta/Entra get no email claim)

Summary

Kratos supports claims_source: userinfo per OIDC provider, and it is required for identity providers whose authorization-code flow issues "thin" ID tokens Okta's org authorization server is the canonical example: profile/email claims are only served from the userinfo endpoint. The chart's provider template renders a fixed field list and silently discards any other key, so a generic Okta provider fails at registration with missing properties: "email".

Chart version: 1.13.4 (main @ 3f6da06).

Details

https://github.com/l3montree-dev/devguard-helm-chart/blob/3f6da06d041aeb5f975ff1d4ef59ce23bcb9cced/templates/kratos/kratos-config.yaml#L93-L109

Only id, provider, clientId, issuerUrl and scope are passed through. The workaround we run today is a raw kratos env override via kratos.additionalEnvs:

kratos:
  additionalEnvs:
    SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS_0_CLAIMS_SOURCE: userinfo

which works but is index-coupled to the providers list and easy to break.

Proposal

{{- if .claimsSource }}
  claims_source: {{ .claimsSource }}
{{- end }}

in the provider range, plus the field in schema/schema.ts.

Read templates/kratos/kratos-config.yaml around the provider range and schema/schema.ts to compare the supported provider fields with the issue's claimsSource example. Render the chart with claimsSource set and verify the generated Kratos configuration preserves claims_source without breaking providers that omit it.