fix(auth): repair the inert auth configuration schema

The schema string was the inside of a "properties" block: jwts, oidc, ldap and
required sat at the root with no enclosing "type"/"properties". jsonschema
compiled it as a document with only unknown keywords, so every auth section
validated and no option was ever checked.

Wrapped it correctly and dropped the root-level required: ["jwts"]. Init logs
and continues when the jwts section is absent ("Missing JWT configuration: No
JWT token support!"), so enforcing it would abort OIDC- or LDAP-only
deployments that work today. The per-subsection required lists are unchanged.

Validation errors are now printed with err.Error() instead of %#v, which
rendered a jsonschema.ValidationError unreadably.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

internal/config/validate.go

@@ -24,6 +24,6 @@ func Validate(schema string, instance json.RawMessage) {
 	}
 
 	if err = sch.Validate(v); err != nil {
-		cclog.Fatalf("%#v", err)
+		cclog.Fatalf("config validation failed: %s", err.Error())
 	}
 }