fix(auth): derive SSO display name from email local-part

[hunzlahmalik]

Summary

• Drop the x-auth-request-user header read in the ForwardAuth middleware — oauth2-proxy was putting the Cognito sub UUID into that header, so newly-provisioned SSO users landed with a UUID (e.g. 892ae5ac-0021-…) as their User.name.
• Use the email local-part as the display name. The middleware already fell back to this value when the header was absent; we're promoting that fallback to the only source.
• Consolidate the two SSO-provision tests in authentication.test.ts into one — after the fix, the x-auth-request-user-absent branch is the only branch. Also update the AUTH_TYPE JSDoc in env.ts to drop the stale mention of X-Auth-Request-User.

Existing users with UUID name values are not auto-corrected — the middleware does not re-sync the field on subsequent logins. A backfill is out of scope here.

Test plan

• yarn test server/middlewares/authentication.test.ts passes
• yarn tsc --noEmit passes
• Devstack end-to-end: a fresh Cognito user whose cognito:username is the bare sub UUID lands at https://foss-wiki.local.moneta.dev with User.name = email local-part, not the UUID
• SELECT email, name FROM users ORDER BY "createdAt" DESC LIMIT 5; reflects the new behavior

🤖 Generated with Claude Code