fix: admin role mapping grants only, revoke behind opt-in

SSO login for an existing admin whose token lacked the admin role was
silently demoting the account, locking admins out of the dashboard.
Missing admin role now leaves the flag alone unless
RevokeAdminWithoutRole is enabled.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Jellyfin.Plugin.OidcAuth/Configuration/PluginConfiguration.cs

@@ -50,6 +50,12 @@ public class PluginConfiguration : BasePluginConfiguration
     /// </summary>
     public string AllowedRoles { get; set; } = string.Empty;
 
+    /// <summary>
+    /// Gets or sets a value indicating whether a missing admin role also revokes an
+    /// existing administrator flag on OIDC login. Off by default: admin roles only grant.
+    /// </summary>
+    public bool RevokeAdminWithoutRole { get; set; }
+
     /// <summary>
     /// Gets or sets a value indicating whether unknown users are created on first login.
     /// </summary>