fix: admin role mapping grants only, revoke behind opt-in

SSO login for an existing admin whose token lacked the admin role was
silently demoting the account, locking admins out of the dashboard.
Missing admin role now leaves the flag alone unless
RevokeAdminWithoutRole is enabled.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

manifest.json

@@ -7,6 +7,14 @@
         "owner": "pascallinxweiler",
         "category": "Authentication",
         "versions": [
+            {
+                "version": "1.0.3.0",
+                "changelog": "Admin role mapping now only grants admin by default. New opt-in setting 'Also revoke admin when the admin role is missing' restores the old revoking behavior.",
+                "targetAbi": "10.11.0.0",
+                "sourceUrl": "https://git.linxweiler.xyz/pascallinxweiler/jellyfinplugin/raw/branch/main/dist/oidc-auth_1.0.3.0.zip",
+                "checksum": "8e1435d2d4a1587797f9c0af53f6fca2",
+                "timestamp": "2026-07-13T13:00:00Z"
+            },
             {
                 "version": "1.0.2.0",
                 "changelog": "Log OIDC claims and admin mapping decisions; role comparison is now case-insensitive.",