fix(ssf): 修复 Verification 状态迁移

为已执行旧版 0062 的环境补充不可变修复迁移，恢复 Stream 状态字段和 Verification challenge 表；同时为 timestamptz 参数增加显式类型，避免 pgx 在真实 PostgreSQL 中推断冲突。\n\n验证：pnpm test；pnpm lint；pnpm build；真实 PostgreSQL 集成测试通过。

apps/api/internal/store/security_events.go

@@ -144,7 +144,7 @@ WHERE issuer=$1 AND audience=$2`, issuer, audience, stateHash, now)
 	}
 	if _, err := tx.Exec(ctx, `
 INSERT INTO gateway_security_event_verification_challenges(issuer,audience,state_hash,created_at,expires_at)
-VALUES($1,$2,$3,$4,$4 + interval '180 seconds')
+VALUES($1,$2,$3,$4::timestamptz,$4::timestamptz + interval '180 seconds')
 ON CONFLICT(issuer,audience,state_hash) DO NOTHING`, issuer, audience, stateHash, now); err != nil {
 		return err
 	}
@@ -278,7 +278,7 @@ UPDATE gateway_security_event_stream_state
 SET mode='introspection_fallback',fallback_since=COALESCE(fallback_since,$3),
     consecutive_verifications=0,last_error_category='verification_stale',updated_at=now()
 WHERE issuer=$1 AND audience=$2 AND mode <> 'introspection_fallback'
-  AND COALESCE(last_verification_at,created_at) < $3 - make_interval(secs => $4::double precision)`,
+  AND COALESCE(last_verification_at,created_at) < $3::timestamptz - make_interval(secs => $4::double precision)`,
 		issuer, audience, now, staleAfter.Seconds())
 	return err
 }

apps/api/internal/store/security_events_integration_test.go

@@ -51,6 +51,9 @@ func TestSecurityEventWatermarkVerificationAndFallbackLifecycle(t *testing.T) {
 		t.Fatal(err)
 	}
 	now := time.Now().UTC().Truncate(time.Second)
+	if err := db.AdvanceSecurityEventStreamState(ctx, issuer, audience, now, 180*time.Second); err != nil {
+		t.Fatalf("advance fresh stream state: %v", err)
+	}
 	evaluation, err := db.EvaluateOIDCSecurityEvent(ctx, issuer, audience, subjectIssuer, tenantID, subject, now, now, 180*time.Second)
 	if err != nil || !evaluation.RequireIntrospection || evaluation.Mode != "bootstrap" {
 		t.Fatalf("bootstrap evaluation=%#v error=%v", evaluation, err)