feat(identity): 增加统一认证管理接口

提供接入码配对、配置查询、本地策略修改、验证、激活、回滚、禁用和公开运行时状态接口。写操作强制 Idempotency-Key 与 If-Match，后台 Exchange 支持重启恢复和过期收敛，并记录脱敏 Trace 与审计。\n\n验证：go test 相关 identity、store、identityruntime、httpapi 包；go vet ./apps/api/...

apps/api/internal/identity/configuration.go

@@ -17,6 +17,27 @@ var (
 	ErrLocalTenantInvalid = errors.New("local tenant mapping is invalid")
 )
 
+type RevisionPolicy struct {
+	LocalTenantKey         string `json:"localTenantKey"`
+	RolePrefix             string `json:"rolePrefix"`
+	JITEnabled             bool   `json:"jitEnabled"`
+	LegacyJWTEnabled       bool   `json:"legacyJwtEnabled"`
+	SessionIdleSeconds     int    `json:"sessionIdleSeconds"`
+	SessionAbsoluteSeconds int    `json:"sessionAbsoluteSeconds"`
+	SessionRefreshSeconds  int    `json:"sessionRefreshSeconds"`
+}
+
+func (policy RevisionPolicy) Validate() error {
+	if strings.TrimSpace(policy.LocalTenantKey) == "" || strings.TrimSpace(policy.RolePrefix) == "" {
+		return errors.New("local tenant mapping and role prefix are required")
+	}
+	if policy.SessionIdleSeconds <= 0 || policy.SessionAbsoluteSeconds <= policy.SessionIdleSeconds ||
+		policy.SessionRefreshSeconds <= 0 || policy.SessionRefreshSeconds >= policy.SessionIdleSeconds {
+		return errors.New("identity session policy is invalid")
+	}
+	return nil
+}
+
 type RevisionState string
 
 const (