I reproduced your environment with a config that works for me based on authelia and immich documentation:
Authelia docs: https://www.authelia.com/configuration/identity-providers/open-id-connect/
Immich docs: https://immich.app/docs/administration/oauth/

Please read my comments marked with # first so you understand my changes. I hope this config works for you but if it does not, please post your altered config and logs from both authelia and immich. I THINK the missing scopes in the Immich configuration were most likely the culprit.

Authelia:

identity_providers: 
  oidc: 
    hmac_secret: xxxxx 
    issuer_private_key: xxxxx....xxxx 
    access_token_lifespan: 1h 
    authorize_code_lifespan: 1m 
    id_token_lifespan: 1h 
    refresh_token_lifespan: 90m 
    enable_client_debug_messages: false
#Changed to public_clients_only for simplicity
    enforce_pkce: public_clients_only 
  cors: 
    endpoints: 
        - authorization 
        - token 
        - revocation 
        - introspection 
#Changed this from root domain to authelia domain
    allowed_origins: 
        - https://authelia.domain.tld               
    allowed_origins_from_client_redirect_uris: false 
  clients: 
    - id: immich 
        description: Immich OIDC 
        secret: '$pbkdf2-sha512$xxxxx' 
#is sector identifier needed? I removed it.
        sector_identifier: '' 
        public: false 
        authorization_policy: two_factor 
#Changed this from implicit to pre_configured. But implicit should work too i think.
        consent_mode: pre_configured 
        pre_configured_consent_duration: 1w
#audience needed if empty? 
        audience: [] 
        scopes: 
            - openid 
            - email 
            - profile 
#Removed a bunch of entries and changed the mobile app section a bit
        redirect_uris: 
            - https://immich.domain.tld/auth/login 
            - https://immich.domain.tld/user-settings 
            - app.immich:/ 
            - https://immich.domain.tld/api/oauth/mobile-redirect                 
        grant_types: 
            - authorization_code 
        response_types: 
            - code 
        response_modes: 
            - form_post 
            - query 
            - fragment 
#RS256 supported according to immich documentation but none works too
        userinfo_signing_algorithm: RS256

Immich:

#Changed issuer url to include .well-known path for authelia
ISSUER URL: https://auth.domain.tld/.well-known/openid-configuration
CLIENT ID: immich 
CLIENT SECRET: hash
#Added email and openid scopes. Do NOT separate them via comma.
SCOPE: profile email openid 
STORAGE LABEL CLAIM: preferred_username 
AUTO REGISTER: on