fix(ssf): 修复安全事件连接基础阻断

为已记录旧迁移版本的环境补充幂等表修复迁移，并让 Transmitter 网络连接在 IPv6 地址不可达时继续尝试 IPv4。失败连接现在通过 If-Match 安全重试，页面同步提供重试入口并清理过期错误提示。\n\n验证：Go securityevents/migrate 测试、Web Vitest 与 TypeScript 类型检查通过。

apps/api/internal/securityevents/connection_manager_test.go

@@ -7,6 +7,7 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -148,6 +149,39 @@ func TestTransmitterSSRFProtectionBlocksReservedNetworks(t *testing.T) {
 	}
 }
 
+func TestDialResolvedAddressesFallsBackFromIPv6ToIPv4(t *testing.T) {
+	listener, err := net.Listen("tcp4", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer listener.Close()
+	port := listener.Addr().(*net.TCPAddr).Port
+	accepted := make(chan struct{})
+	go func() {
+		connection, acceptErr := listener.Accept()
+		if acceptErr == nil {
+			_ = connection.Close()
+			close(accepted)
+		}
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	connection, err := dialResolvedAddresses(ctx, "tcp", strconv.Itoa(port), []net.IPAddr{
+		{IP: net.ParseIP("::1")},
+		{IP: net.ParseIP("127.0.0.1")},
+	}, &net.Dialer{Timeout: 250 * time.Millisecond})
+	if err != nil {
+		t.Fatalf("IPv4 fallback was not attempted: %v", err)
+	}
+	_ = connection.Close()
+	select {
+	case <-accepted:
+	case <-ctx.Done():
+		t.Fatal("IPv4 listener did not receive the fallback connection")
+	}
+}
+
 func TestRetiringConnectionStillAppliesRevocationWatermark(t *testing.T) {
 	audience := "urn:easyai:ssf:receiver:" + uuid.NewString()
 	repository := &memoryConnectionRepository{