Make User.teams populatable from an OIDC claim (config-driven)

[maartendra]

Context

core.models.User.teams ships as a hardcoded return [], with a docstring inviting deployers to wire it to their identity provider. The team-based access model is fully built — ItemAccess.team and the Q(user=user) | Q(team__in=user.teams) filter — but there is no supported way to populate teams without patching the model.

Problem

Every OIDC deployment whose IdP already emits group/team memberships (Keycloak, Authentik, Entra ID, …) has to fork or monkeypatch User.teams to use team workspaces. That is a maintenance burden and a barrier to a feature that is otherwise complete.

Proposal

Add an OIDC_TEAMS_CLAIM setting — a companion to the existing OIDC_STORE_CLAIMS:

• When set, the named claim is stored on the user (via get_extra_claims) and returned by User.teams.
• Default None → unchanged behaviour (empty teams).

Example: OIDC_TEAMS_CLAIM=groups → User.teams returns the user's groups claim, so a workspace shared with ItemAccess(team="<group>") is visible to every member of that group — no fork required.

Happy to PR

I have a PR ready. Two design questions:

• Setting name — is OIDC_TEAMS_CLAIM OK?
• Auto-store the claim (what the PR does) vs. require the deployer to also list it in OIDC_STORE_CLAIMS?

Context: we are deploying Drive as the "drive" pillar of email.eu, a sovereign EU business workspace, wired to Authentik groups. We would rather contribute this upstream than carry a patch.