feat(invitations): add external ID field, CSV header validation, and multi-language parsing

[LWS49]

Summary

Adds an optional External ID field to the course invitation flow (CSV and individual form), so admins can assign institution identifiers during invite. The invite-by-file path gains strict CSV header validation that rejects headerless or malformed uploads with a descriptive error, and the parser now accepts headers in English, Chinese, or Korean (any mix) regardless of column order - matching whatever template the admin downloaded. The result dialog is redesigned into per-outcome sections (new invitees, existing users, failed rows) with a dedicated conflict prompt when an uploaded External ID collides with one already assigned to a course member. Template files are replaced with six localized variants (EN/ZH/KO × timeline/no-timeline), and the download link resolves to the locale-matched file. The External ID column in the Manage Users table is moved to sit after Email, matching the CSV column order.

Design decisions

• Order-independent parsing via header_alias_map - rather than enforcing canonical column order, the parser builds a {canonical_symbol => column_index} map from the header row, so any permutation of the expected columns is accepted. This lets admins reorder columns in their own spreadsheet tools without rejection.
• Set equality for header validation - build_header_map! compares the resolved canonical symbol set against EXPECTED_WITH_TIMELINE / EXPECTED_WITHOUT_TIMELINE using Set#==. Extra unrecognised columns are silently ignored (they produce no entry in the map); missing or entirely wrong headers raise CSV::MalformedCSVError with a localised expected-header list.
• PendingExternalIdUpdates as a raise-to-surface flow - when an upload would change existing External IDs, the service raises rather than proceeding, and the controller catches it to return a pending_conflict response. The frontend then shows a confirmation prompt before the admin can re-submit with external_id_resolution set.
• Six static template files instead of one - templates are locale-specific CSV files imported at build time via Vite's ?url suffix. A TEMPLATE_MAP in helper/index.ts maps { locale: { timeline, noTimeline } } to URLs, with EN as fallback for unsupported locales.

Regression prevention

Covers: EN/ZH/KO header acceptance, mixed-language headers, order-independent column parsing, headerless CSV rejection, old Phase 1 header rejection, timeline-format CSV on a no-timeline course, error message content, template guard (each static template file passes the parser), External ID round-trip through CSV and individual form, conflict detection and resolution flow, result dialog per-outcome sections.

Manual testing confirmed: happy path invite by CSV (EN/ZH/KO templates), template download locale matching, External ID conflict prompt, individual invite with External ID, ManageUsersTable column order.

Existing behaviour preserved: courses without External ID enabled are unaffected; rows with no External ID column value are accepted with nil; BOM-prefixed files continue to parse correctly.