feat(identity): 增加统一认证管理接口

提供接入码配对、配置查询、本地策略修改、验证、激活、回滚、禁用和公开运行时状态接口。写操作强制 Idempotency-Key 与 If-Match，后台 Exchange 支持重启恢复和过期收敛，并记录脱敏 Trace 与审计。\n\n验证：go test 相关 identity、store、identityruntime、httpapi 包；go vet ./apps/api/...

apps/api/internal/identity/pairing_service.go

@@ -129,6 +129,15 @@ func (service *PairingService) Continue(ctx context.Context, pairingID string) (
 		if pairing.Status == PairingCompleted || pairing.Status == PairingFailed || pairing.Status == PairingExpired {
 			return pairing, nil
 		}
+		if !pairing.ExpiresAt.After(time.Now()) {
+			expired, updateErr := service.repository.UpdateIdentityPairingExchange(ctx, pairing.ID, pairing.Version, PairingExchangeUpdate{
+				Status: PairingExpired, RemoteVersion: pairing.RemoteVersion, LastErrorCategory: "exchange_expired",
+			})
+			if updateErr == nil {
+				_ = service.secrets.Delete(ctx, pairing.ExchangeTokenRef)
+			}
+			return expired, updateErr
+		}
 		revision, err := service.repository.IdentityConfigurationRevision(ctx, pairing.RevisionID)
 		if err != nil {
 			return PairingExchange{}, err