feat(sso): strip owner prefix in roleKey; expose /sso/casdoor/config; casdoor env passthrough

- RoleResolver.roleKey 取组名最后一段再匹配前缀，兼容 Casdoor user.groups 的 owner/name 全 ID
- 前端 nginx 增加精确 location /sso/casdoor/config 转发网关
- docker-compose 网关服务透传 DEEPDATA_CASDOOR_* 环境变量（Spring relaxed binding）

scripts/images/frontend/routes.inc

@@ -29,6 +29,14 @@ location /deepflow-backend {
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 }
 
+# Casdoor SSO 前端配置端点（无 /api 前缀，供登录弹窗探测 SSO 是否启用）
+location = /sso/casdoor/config {
+    proxy_pass http://deepdata-gateway:8080/sso/casdoor/config;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+}
+
 location @static_fallback {
     root   /opt/frontend/statics;
     try_files $uri $uri/ /index.html;