feat(sso): strip owner prefix in roleKey; expose /sso/casdoor/config; casdoor env passthrough

- RoleResolver.roleKey 取组名最后一段再匹配前缀，兼容 Casdoor user.groups 的 owner/name 全 ID
- 前端 nginx 增加精确 location /sso/casdoor/config 转发网关
- docker-compose 网关服务透传 DEEPDATA_CASDOOR_* 环境变量（Spring relaxed binding）

deployment/docker/deepdata/docker-compose.yml

@@ -71,6 +71,15 @@ services:
       - JWT_SECRET=${JWT_SECRET:-}
       - DB_PASSWORD=${DB_PASSWORD:?DB_PASSWORD is required. Set in .env file}
       - deepdata.jwt.enable=${DEEPDATA_JWT_ENABLE:-false}
+      # ---- Casdoor SSO（M1/M2）：空值保持 Spring 默认；生产经 .env 注入 ----
+      - DEEPDATA_CASDOOR_ENABLED=${DEEPDATA_CASDOOR_ENABLED:-false}
+      - DEEPDATA_CASDOOR_ISSUER=${DEEPDATA_CASDOOR_ISSUER:-}
+      - DEEPDATA_CASDOOR_AUTHORIZEURI=${DEEPDATA_CASDOOR_AUTHORIZE_URI:-}
+      - DEEPDATA_CASDOOR_TOKENURI=${DEEPDATA_CASDOOR_TOKEN_URI:-}
+      - DEEPDATA_CASDOOR_JWKSURI=${DEEPDATA_CASDOOR_JWKS_URI:-}
+      - DEEPDATA_CASDOOR_CLIENTID=${DEEPDATA_CASDOOR_CLIENT_ID:-}
+      - DEEPDATA_CASDOOR_CLIENTSECRET=${DEEPDATA_CASDOOR_CLIENT_SECRET:-}
+      - DEEPDATA_CASDOOR_REDIRECTURI=${DEEPDATA_CASDOOR_REDIRECT_URI:-}
       - LOG_ROTATION_MAX_SIZE=${LOG_ROTATION_MAX_SIZE:-100MB}
       - LOG_ROTATION_BACKUP_COUNT=${LOG_ROTATION_BACKUP_COUNT:-30}
     volumes: