feat: combined SSO improvements and CLI version flags - #13

Combined deployment branch for memos.oneal.im. Not intended for upstream — this is the integration branch that cherry-picks the six isolated feature PRs in lowest-conflict order.

Included PRs (in apply order)

Conflicts resolved

• CreateIdentityProviderDialog.tsx: docs(SSO): explain SSO filters with RE2 tester usememos/memos#6297 regex101 link preserved in feat(SSO): allow SSO filters on arbitrary claims usememos/memos#6301 restructured filter-pattern field; feat(SSO): separate External ID from Username mapping usememos/memos#6295 username field inserted alongside docs(SSO): claim mapping defaults and suggested values usememos/memos#6300 description props
• en.json: all locale keys from all four UI PRs kept
• oauth2.go: Claims map population (feat(SSO): allow SSO filters on arbitrary claims usememos/memos#6301) + firstMappedClaim refactor (feat: support ordered SSO claim fallbacks usememos/memos#6296) applied to all fields including username (feat(SSO): separate External ID from Username mapping usememos/memos#6295)
• oauth2_test.go: both new test functions kept
• Generated proto files: regenerated with buf generate from merged proto sources

Verification

• go build passes
• go test passes
• go vet clean
• buf generate produces no diff
• Deployed to memos.oneal.im as version memos-oneal-im (commit 1768c8d0)