fix(ssf): 修复 Verification 状态迁移

为已执行旧版 0062 的环境补充不可变修复迁移，恢复 Stream 状态字段和 Verification challenge 表；同时为 timestamptz 参数增加显式类型，避免 pgx 在真实 PostgreSQL 中推断冲突。\n\n验证：pnpm test；pnpm lint；pnpm build；真实 PostgreSQL 集成测试通过。

apps/api/internal/store/security_events_integration_test.go

@@ -51,6 +51,9 @@ func TestSecurityEventWatermarkVerificationAndFallbackLifecycle(t *testing.T) {
 		t.Fatal(err)
 	}
 	now := time.Now().UTC().Truncate(time.Second)
+	if err := db.AdvanceSecurityEventStreamState(ctx, issuer, audience, now, 180*time.Second); err != nil {
+		t.Fatalf("advance fresh stream state: %v", err)
+	}
 	evaluation, err := db.EvaluateOIDCSecurityEvent(ctx, issuer, audience, subjectIssuer, tenantID, subject, now, now, 180*time.Second)
 	if err != nil || !evaluation.RequireIntrospection || evaluation.Mode != "bootstrap" {
 		t.Fatalf("bootstrap evaluation=%#v error=%v", evaluation, err)