fix(auth): repair the inert auth configuration schema

The schema string was the inside of a "properties" block: jwts, oidc, ldap and
required sat at the root with no enclosing "type"/"properties". jsonschema
compiled it as a document with only unknown keywords, so every auth section
validated and no option was ever checked.

Wrapped it correctly and dropped the root-level required: ["jwts"]. Init logs
and continues when the jwts section is absent ("Missing JWT configuration: No
JWT token support!"), so enforcing it would abort OIDC- or LDAP-only
deployments that work today. The per-subsection required lists are unchanged.

Validation errors are now printed with err.Error() instead of %#v, which
rendered a jsonschema.ValidationError unreadably.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

internal/auth/schema.go

@@ -5,8 +5,13 @@
 
 package auth
 
+// configSchema describes the "auth" section of config.json. Every subsection is
+// optional: Init() logs and continues when "jwts", "oidc" or "ldap" is absent,
+// so only the fields within a configured subsection are required.
 var configSchema = `
-	{
+{
+  "type": "object",
+  "properties": {
     "jwts": {
       "description": "For JWT token authentication.",
       "type": "object",
@@ -55,6 +60,7 @@ var configSchema = `
       "required": ["max-age"]
     },
     "oidc": {
+      "description": "For OpenID Connect authentication.",
       "type": "object",
       "properties": {
         "provider": {
@@ -148,6 +154,6 @@ var configSchema = `
         }
       },
       "required": ["url", "user-base", "search-dn", "user-bind", "user-filter"]
-    },
-  "required": ["jwts"]
-	}`
+    }
+  }
+}`