feat(ssf): 增加连接操作审计与追踪证据

安全事件连接的成功和运行时失败现在写入脱敏审计，响应携带 Trace ID 与 Audit ID，管理页面展示最近一次成功操作证据。审计仅记录连接状态、健康模式和错误类别，不采集授权头、Token、Bearer 或 Secret。\n\n验证：HTTP API、Store、Security Events Go 测试以及 Web Vitest、TypeScript 类型检查通过。

apps/api/internal/httpapi/security_event_connection_handlers_test.go

@@ -7,9 +7,36 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/auth"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/config"
+	ssfreceiver "github.com/easyai/easyai-ai-gateway/apps/api/internal/securityevents"
 )
 
+func TestSecurityEventConnectionTraceAndAuditProjection(t *testing.T) {
+	request := httptest.NewRequest(http.MethodPut, "/connection", nil)
+	request.Header.Set("Authorization", "Bearer must-not-escape")
+	recorder := httptest.NewRecorder()
+	traceID := ensureSecurityEventTraceID(recorder, request)
+	if traceID == "" || recorder.Header().Get("X-Trace-Id") != traceID {
+		t.Fatalf("trace header=%q trace=%q", recorder.Header().Get("X-Trace-Id"), traceID)
+	}
+	actor := &auth.User{ID: "admin-id", Username: "admin", Source: "local", Roles: []string{"manager"}}
+	connection := ssfreceiver.ConnectionView{ConnectionID: "connection-id", LifecycleStatus: "error", HealthMode: "introspection_fallback"}
+	input := securityEventConnectionAuditInput(request, actor, "connect", "failure", "management_token_failed", traceID, connection)
+	payload, err := json.Marshal(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if input.Action != "identity.security_event_connection.connect" || input.TargetID != "connection-id" || input.Metadata["traceId"] != traceID {
+		t.Fatalf("audit input=%#v", input)
+	}
+	for _, forbidden := range []string{"must-not-escape", "authorization_header", "push_bearer", "credential_ref"} {
+		if strings.Contains(strings.ToLower(string(payload)), forbidden) {
+			t.Fatalf("audit payload exposed forbidden field %q: %s", forbidden, payload)
+		}
+	}
+}
+
 func TestSecurityEventConnectionWriteHeaders(t *testing.T) {
 	request := httptest.NewRequest(http.MethodPost, "/connection/verify", nil)
 	recorder := httptest.NewRecorder()