Update OIDC configuration in Headlamp documentation and Talos config to use preferred_username claim instead of email. Added troubleshooting steps for "Unauthorized" errors related to OIDC token validation.

talos/talconfig.with-longhorn.yaml

@@ -103,5 +103,6 @@ patches:
         extraArgs:
           oidc-issuer-url: https://auth.apps.noble.lab.pcenicni.dev/application/o/headlamp/
           oidc-client-id: headlamp
-          oidc-username-claim: email
+          # Not "email": kube-apiserver rejects tokens when email_verified is false; Authentik often emits that.
+          oidc-username-claim: preferred_username
           oidc-groups-claim: groups

talos/talconfig.yaml

@@ -103,5 +103,6 @@ patches:
         extraArgs:
           oidc-issuer-url: https://auth.apps.noble.lab.pcenicni.dev/application/o/headlamp/
           oidc-client-id: headlamp
-          oidc-username-claim: email
+          # Not "email": kube-apiserver rejects tokens when email_verified is false; Authentik often emits that.
+          oidc-username-claim: preferred_username
           oidc-groups-claim: groups