fix(auth): support employee ID usernames

Assisted-by: Codex:GPT-5

routers/web/auth/auth_test.go

@@ -184,6 +184,20 @@ func TestWebAuthOAuth2(t *testing.T) {
 	})
 }
 
+func TestExtractUserNameFromOAuth2EmployeeID(t *testing.T) {
+	defer test.MockVariableValue(&setting.OAuth2Client.Username, setting.OAuth2UsernameEmployeeID)()
+
+	username, err := extractUserNameFromOAuth2(&goth.User{
+		RawData: map[string]any{"employee_id": "RC001"},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "RC001", username)
+
+	username, err = extractUserNameFromOAuth2(&goth.User{RawData: map[string]any{}})
+	require.NoError(t, err)
+	assert.Empty(t, username)
+}
+
 func TestOpenIDRequireTwoFactor(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
 	mockOpt := contexttest.MockContextOption{SessionStore: session.NewMockMemStore("dummy-sid-openid")}