Defined the standard profile and email client scopes in the realm (#6)

The schuly-app client referenced email, profile, roles and web-origins scopes
that the realm never defined, so Keycloak ignored them on import and only
groups survived — leaving the app's authorize request to fail with
invalid_scope. Define profile (name, username, given/family name, picture) and
email (email, email_verified) scopes, make them realm defaults, assign them to
schuly-app, and request offline_access as an optional scope.

Author: PianoNic

realms/schuly-realm.json

@@ -22,7 +22,7 @@
     { "name": "Teacher", "realmRoles": ["Teacher"] },
     { "name": "Administrator", "realmRoles": ["Administrator"] }
   ],
-  "defaultDefaultClientScopes": ["groups"],
+  "defaultDefaultClientScopes": ["groups", "profile", "email"],
   "clientScopes": [
     {
       "name": "groups",
@@ -44,6 +44,71 @@
           }
         }
       ]
+    },
+    {
+      "name": "profile",
+      "protocol": "openid-connect",
+      "description": "Standard OIDC profile claims (name, username, picture).",
+      "attributes": { "include.in.token.scope": "true", "display.on.consent.screen": "false" },
+      "protocolMappers": [
+        {
+          "name": "full name",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-full-name-mapper",
+          "consentRequired": false,
+          "config": { "id.token.claim": "true", "access.token.claim": "true", "userinfo.token.claim": "true" }
+        },
+        {
+          "name": "username",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-property-mapper",
+          "consentRequired": false,
+          "config": { "user.attribute": "username", "claim.name": "preferred_username", "jsonType.label": "String", "id.token.claim": "true", "access.token.claim": "true", "userinfo.token.claim": "true" }
+        },
+        {
+          "name": "given name",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-property-mapper",
+          "consentRequired": false,
+          "config": { "user.attribute": "firstName", "claim.name": "given_name", "jsonType.label": "String", "id.token.claim": "true", "access.token.claim": "true", "userinfo.token.claim": "true" }
+        },
+        {
+          "name": "family name",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-property-mapper",
+          "consentRequired": false,
+          "config": { "user.attribute": "lastName", "claim.name": "family_name", "jsonType.label": "String", "id.token.claim": "true", "access.token.claim": "true", "userinfo.token.claim": "true" }
+        },
+        {
+          "name": "picture",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-attribute-mapper",
+          "consentRequired": false,
+          "config": { "user.attribute": "picture", "claim.name": "picture", "jsonType.label": "String", "id.token.claim": "true", "access.token.claim": "true", "userinfo.token.claim": "true" }
+        }
+      ]
+    },
+    {
+      "name": "email",
+      "protocol": "openid-connect",
+      "description": "Standard OIDC email claims.",
+      "attributes": { "include.in.token.scope": "true", "display.on.consent.screen": "false" },
+      "protocolMappers": [
+        {
+          "name": "email",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-property-mapper",
+          "consentRequired": false,
+          "config": { "user.attribute": "email", "claim.name": "email", "jsonType.label": "String", "id.token.claim": "true", "access.token.claim": "true", "userinfo.token.claim": "true" }
+        },
+        {
+          "name": "email verified",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-property-mapper",
+          "consentRequired": false,
+          "config": { "user.attribute": "emailVerified", "claim.name": "email_verified", "jsonType.label": "boolean", "id.token.claim": "true", "access.token.claim": "true", "userinfo.token.claim": "true" }
+        }
+      ]
     }
   ],
   "clients": [
@@ -59,7 +124,8 @@
       "redirectUris": ["schulytest://callback", "schuly://callback"],
       "webOrigins": ["+"],
       "attributes": { "pkce.code.challenge.method": "S256" },
-      "defaultClientScopes": ["groups", "email", "profile", "roles", "web-origins"]
+      "defaultClientScopes": ["groups", "profile", "email"],
+      "optionalClientScopes": ["offline_access"]
     }
   ],
   "authenticationFlows": [