feat: add endpoint and CLI for users to view their own OIDC claims (#23053)

- Adds a new API endpoint `GET /api/v2/users/oidc-claims` that returns
only the **merged claims** (not the separate id_token/userinfo
breakdown). Scoped exclusively to the authenticated user's own identity
— no user parameter, so users cannot view each other's claims.
- Adds a new CLI command:** `coder users oidc-claims` that hits the
above endpoint.
- The existing owner-only debug endpoint is preserved unchanged for
admins who need the full claim breakdown.


> 🤖 This PR was created with the help of Coder Agents, and will be
reviewed by my human. 🧑‍💻

docs/reference/api/schemas.md

@@ -5768,6 +5768,20 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `iconUrl`    | string  | false    |              |             |
 | `signInText` | string  | false    |              |             |
 
+## codersdk.OIDCClaimsResponse
+
+```json
+{
+  "claims": {}
+}
+```
+
+### Properties
+
+| Name     | Type   | Required | Restrictions | Description                                                                                                                                                                 |
+|----------|--------|----------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `claims` | object | false    |              | Claims are the merged claims from the OIDC provider. These are the union of the ID token claims and the userinfo claims, where userinfo claims take precedence on conflict. |
+
 ## codersdk.OIDCConfig
 
 ```json

docs/reference/api/users.md

@@ -376,6 +376,37 @@ curl -X GET http://coder-server:8080/api/v2/users/oauth2/github/device \
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
+## Get OIDC claims for the authenticated user
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X GET http://coder-server:8080/api/v2/users/oidc-claims \
+  -H 'Accept: application/json' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`GET /users/oidc-claims`
+
+### Example responses
+
+> 200 Response
+
+```json
+{
+  "claims": {}
+}
+```
+
+### Responses
+
+| Status | Meaning                                                 | Description | Schema                                                               |
+|--------|---------------------------------------------------------|-------------|----------------------------------------------------------------------|
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.OIDCClaimsResponse](schemas.md#codersdkoidcclaimsresponse) |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
 ## OpenID Connect Callback
 
 ### Code samples

docs/reference/cli/users.md

@@ -15,12 +15,13 @@ coder users [subcommand]
 
 ## Subcommands
 
-| Name                                             | Purpose                                                                               |
-|--------------------------------------------------|---------------------------------------------------------------------------------------|
-| [<code>create</code>](./users_create.md)         | Create a new user.                                                                    |
-| [<code>list</code>](./users_list.md)             | Prints the list of users.                                                             |
-| [<code>show</code>](./users_show.md)             | Show a single user. Use 'me' to indicate the currently authenticated user.            |
-| [<code>delete</code>](./users_delete.md)         | Delete a user by username or user_id.                                                 |
-| [<code>edit-roles</code>](./users_edit-roles.md) | Edit a user's roles by username or id                                                 |
-| [<code>activate</code>](./users_activate.md)     | Update a user's status to 'active'. Active users can fully interact with the platform |
-| [<code>suspend</code>](./users_suspend.md)       | Update a user's status to 'suspended'. A suspended user cannot log into the platform  |
+| Name                                               | Purpose                                                                               |
+|----------------------------------------------------|---------------------------------------------------------------------------------------|
+| [<code>create</code>](./users_create.md)           | Create a new user.                                                                    |
+| [<code>list</code>](./users_list.md)               | Prints the list of users.                                                             |
+| [<code>show</code>](./users_show.md)               | Show a single user. Use 'me' to indicate the currently authenticated user.            |
+| [<code>delete</code>](./users_delete.md)           | Delete a user by username or user_id.                                                 |
+| [<code>edit-roles</code>](./users_edit-roles.md)   | Edit a user's roles by username or id                                                 |
+| [<code>oidc-claims</code>](./users_oidc-claims.md) | Display the OIDC claims for the authenticated user.                                   |
+| [<code>activate</code>](./users_activate.md)       | Update a user's status to 'active'. Active users can fully interact with the platform |
+| [<code>suspend</code>](./users_suspend.md)         | Update a user's status to 'suspended'. A suspended user cannot log into the platform  |

docs/reference/cli/users_oidc-claims.md

@@ -0,0 +1,42 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+# users oidc-claims
+
+Display the OIDC claims for the authenticated user.
+
+## Usage
+
+```console
+coder users oidc-claims [flags]
+```
+
+## Description
+
+```console
+  - Display your OIDC claims:
+
+     $ coder users oidc-claims
+
+  - Display your OIDC claims as JSON:
+
+     $ coder users oidc-claims -o json
+```
+
+## Options
+
+### -c, --column
+
+|         |                           |
+|---------|---------------------------|
+| Type    | <code>[key\|value]</code> |
+| Default | <code>key,value</code>    |
+
+Columns to display in table output.
+
+### -o, --output
+
+|         |                          |
+|---------|--------------------------|
+| Type    | <code>table\|json</code> |
+| Default | <code>table</code>       |
+
+Output format.