Added the basic client scope so tokens carry a sub claim (#8)

Keycloak 19+ moved the sub claim into the built-in basic client scope, which the
realm never defined (it only had groups/profile/email), so issued tokens had no
subject and the backend rejected every authenticated call with "No authenticated
user". Define the basic scope (sub + auth_time), make it a realm default and
assign it to schuly-app.

Author: PianoNic

realms/schuly-realm.json

@@ -22,8 +22,30 @@
     { "name": "Teacher", "realmRoles": ["Teacher"] },
     { "name": "Administrator", "realmRoles": ["Administrator"] }
   ],
-  "defaultDefaultClientScopes": ["groups", "profile", "email"],
+  "defaultDefaultClientScopes": ["basic", "groups", "profile", "email"],
   "clientScopes": [
+    {
+      "name": "basic",
+      "protocol": "openid-connect",
+      "description": "OIDC basic claims (sub, auth_time). Required so tokens carry a subject.",
+      "attributes": { "include.in.token.scope": "false", "display.on.consent.screen": "false" },
+      "protocolMappers": [
+        {
+          "name": "sub",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-sub-mapper",
+          "consentRequired": false,
+          "config": { "access.token.claim": "true", "introspection.token.claim": "true" }
+        },
+        {
+          "name": "auth_time",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usersessionmodel-note-mapper",
+          "consentRequired": false,
+          "config": { "user.session.note": "AUTH_TIME", "claim.name": "auth_time", "jsonType.label": "long", "id.token.claim": "true", "access.token.claim": "true" }
+        }
+      ]
+    },
     {
       "name": "groups",
       "protocol": "openid-connect",
@@ -124,7 +146,7 @@
       "redirectUris": ["schulytest://callback", "schuly://callback"],
       "webOrigins": ["+"],
       "attributes": { "pkce.code.challenge.method": "S256" },
-      "defaultClientScopes": ["groups", "profile", "email"],
+      "defaultClientScopes": ["basic", "groups", "profile", "email"],
       "optionalClientScopes": ["offline_access"]
     }
   ],