fix(oidc): 修复登录会话落库兼容问题

部分已配对环境在 0090 首次执行后缺少 oidc_client_id，导致统一认证完成投影后无法写入 Gateway 服务端会话。新增幂等前向迁移补齐该列，并为 Token 处理及会话创建增加不泄露凭据的稳定失败分类和关联诊断。\n\n验证：OIDC Session 全量单测、HTTP 回调定向测试、迁移升级集成测试、隔离 PostgreSQL 跨仓库 OIDC E2E 和本地 Chrome 真实登录均通过。

apps/api/cmd/migrate/main_test.go

@@ -317,6 +317,34 @@ SET last_error_category='still-invalid' WHERE id=$1::uuid`, pairingID)
 	}
 }
 
+func TestOIDCSessionClientIdentityRepairMigrationUpgradesApplied0090Schema(t *testing.T) {
+	pool := newIdentityMigrationPostgresTestSchema(t)
+	ctx := context.Background()
+	if _, err := pool.Exec(ctx, `
+CREATE TABLE gateway_oidc_sessions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  oidc_user_binding_id uuid
+)`); err != nil {
+		t.Fatalf("create pre-repair OIDC session schema: %v", err)
+	}
+
+	applyIdentityMigrationTestFile(t, ctx, pool, "../../migrations/0091_oidc_session_client_identity.sql")
+	applyIdentityMigrationTestFile(t, ctx, pool, "../../migrations/0091_oidc_session_client_identity.sql")
+
+	var dataType string
+	if err := pool.QueryRow(ctx, `
+SELECT data_type
+FROM information_schema.columns
+WHERE table_schema=current_schema()
+  AND table_name='gateway_oidc_sessions'
+  AND column_name='oidc_client_id'`).Scan(&dataType); err != nil {
+		t.Fatalf("read repaired OIDC session client identity column: %v", err)
+	}
+	if dataType != "text" {
+		t.Fatalf("oidc_client_id data type=%q, want text", dataType)
+	}
+}
+
 func applyIdentityMigrationTestFile(t *testing.T, ctx context.Context, pool *pgxpool.Pool, path string) {
 	t.Helper()
 	payload, err := os.ReadFile(path)