OIDC groups implementation

- Add Groups field to User struct with JSON storage
- Include GetGroups() and SetGroups() helper methods
- Extract groups from OIDC claims in FromClaim()
- Add database migration 202509161200 for groups column
- Update config-example.yaml with groups scope
- Add comprehensive documentation and testing

config-example.yaml

@@ -355,9 +355,10 @@ unix_socket_permission: "0770"
 #   use_expiry_from_token: false
 #
 #   # The OIDC scopes to use, defaults to "openid", "profile" and "email".
+#   # Add "groups" scope to enable group storage for external integrations.
 #   # Custom scopes can be configured as needed, be sure to always include the
 #   # required "openid" scope.
-#   scope: ["openid", "profile", "email"]
+#   scope: ["openid", "profile", "email", "groups"]
 #
 #   # Provide custom key/value pairs which get sent to the identity provider's
 #   # authorization endpoint.