Configurable OIDC username claim (preferred_username vs. name)

[eimimue]

Problem
TREK currently uses the OIDC name claim as the account's username/display name.
For providers where name is the full given+family name (e.g. Pocket ID, and many
other OIDC IdPs following the standard claim set), this results in usernames like
"Jane Doe" instead of a clean handle, with no way to change it — the profile gets
re-synced from the OIDC claims on every login (as fixed in #1274 for the admin
role), so manually editing the username in Admin → Users doesn't stick.

Proposed solution
Add an OIDC_USERNAME_CLAIM environment variable (default: name, for backwards
compatibility) that lets admins choose which claim populates the username field,
e.g.:

OIDC_USERNAME_CLAIM=preferred_username

This is the same pattern already used by other self-hosted apps that integrate
with Pocket ID and similar OIDC providers (Nextcloud's --mapping-uid, Portainer,
Semaphore UI's username_claim, Outline's OIDC_USERNAME_CLAIM).

Alternative
A fallback chain (e.g. try preferred_username, then fall back to name) would
also solve this without requiring configuration for providers that don't send
preferred_username.

[mauriceboe]

Done: there's a new OIDC_USERNAME_CLAIM env variable, so you can set it to preferred_username and new SSO accounts get that as their username (unset keeps the old behaviour). It's coming in the next big update.