fix: harden OIDC weak RSA fallback

config.example.yaml

@@ -224,6 +224,11 @@ integration:
 #   - "open_id"
 #   - "email"
 
+# Allow ID token verification with legacy RSA keys smaller than 2048 bits.
+# This is disabled by default because it lowers token verification security and
+# should only be used as a temporary compatibility workaround.
+# allow_weak_rsa_keys: false
+
 # Extra query parameters can be passed to the authorization endpoint
 # by setting them here. This is useful for providers that require any kind
 # of custom hinting.