Header size #36

In the cookmate-web nginx image, OIDC logins fail behind a reverse proxy with nginx "400 Request Header Or Cookie Too Large". Cause: after an OIDC login the chunked ASP.NET auth cookie (.AspNetCore.Cookies*) plus the OIDC correlation/nonce cookies exceed nginx's default large_client_header_buffers 4 8k. Please raise the header buffers in the image's nginx config so OIDC deployments work out of the box — add to the http block: large_client_header_buffers 8 32k; and client_header_buffer_size 16k; (or make them env-configurable). Separately, the API's OIDC RequireVerifiedEmail defaults to true, but trusted first-party IdPs like Authentik send email_verified: false by default, so SSO users get rejected with ?error=unverified and never provision — please document that operators should set RequireVerifiedEmail=false for a trusted IdP, and/or reconsider the default. Verify with a real OIDC provider that a fresh login completes without a 400 and provisions the first user as admin.