Feature Request: Map OIDC group claims to Collections (post-authentication)

Describe the feature When using OIDC SSO (e.g. via Authentik), group information is already included in the ID token (groups claim). However, Vaultwarden currently ignores these claims entirely. It would be useful to support optional mapping of OIDC group claims to Vaultwarden Collections (or organization memberships) after successful authentication. --- Current behavior • OIDC login works correctly • User is created (if enabled) • Group claims (e.g. groups) are ignored • Collection membership must be managed manually inside Vaultwarden --- Expected behavior After a successful OIDC login: • Vaultwarden reads group claims from the ID token (e.g. groups) • A configurable mapping is applied, e.g.: • User is automatically assigned to the corresponding collections This should be: • Optional (disabled by default) • Configurable (mapping table or environment config) • Applied only after …