feat(auth): OIDC link by preferred_username (opt-in)

Adds OIDC_LINK_BY_USERNAME as a last-resort linking step after
(issuer, sub) and email both miss. Matches IdP preferred_username
against users.username.

Why: local accounts created before OIDC never collected an email
(no UI for it), so the email fallback cannot relink them. A new
SSO login therefore falls into JIT and creates username-1. On a
single-tenant homelab where the IdP owns the namespace, matching
by username is safe and makes first-time SSO transparent for
pre-existing users. Gated behind a flag so multi-tenant deployments
keep the stricter default.

docker-compose.yml

@@ -69,6 +69,7 @@ services:
       - OIDC_PROVIDER_LABEL=${OIDC_PROVIDER_LABEL:-Authentik}
       - OIDC_ALLOW_SIGNUP=${OIDC_ALLOW_SIGNUP:-true}
       - OIDC_ADMIN_GROUPS=${OIDC_ADMIN_GROUPS:-}
+      - OIDC_LINK_BY_USERNAME=${OIDC_LINK_BY_USERNAME:-false}
       - SESSION_SECRET=${SESSION_SECRET:-}
       - LOG_LEVEL=${LOG_LEVEL:-INFO}
       - TZ=${TZ:-UTC}