chore(merge): 整合最新 main 与统一认证变更

合并远端生产 CI、依赖与 API 文档改动，保留统一认证和 SSF 能力。由于远端生产基线已占用 0062，将尚未发布的身份迁移整理为 0063 至 0068 的最终增量 Schema，移除仅用于开发期草稿升级的破坏性迁移步骤。

验证：go test ./...。其余生产门禁在合并提交后继续执行。

apps/api/migrations/0063_oidc_security_events.sql

@@ -0,0 +1,70 @@
+CREATE TABLE IF NOT EXISTS gateway_security_event_receipts (
+  issuer text NOT NULL,
+  jti uuid NOT NULL,
+  audience text NOT NULL,
+  event_type text NOT NULL,
+  transaction_id text,
+  tenant_id text,
+  subject_hash text,
+  event_timestamp timestamptz,
+  received_at timestamptz NOT NULL DEFAULT now(),
+  processed_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (issuer, jti)
+);
+
+CREATE INDEX IF NOT EXISTS idx_gateway_security_event_receipts_received
+  ON gateway_security_event_receipts(received_at DESC);
+
+CREATE TABLE IF NOT EXISTS gateway_oidc_revocation_watermarks (
+  issuer text NOT NULL,
+  tenant_id text NOT NULL,
+  subject text NOT NULL,
+  revoked_at timestamptz NOT NULL,
+  source_jti uuid NOT NULL,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (issuer, tenant_id, subject)
+);
+
+CREATE INDEX IF NOT EXISTS idx_gateway_oidc_revocation_watermarks_lookup
+  ON gateway_oidc_revocation_watermarks(issuer, tenant_id, subject, revoked_at);
+
+CREATE TABLE IF NOT EXISTS gateway_security_event_stream_state (
+  issuer text NOT NULL,
+  audience text NOT NULL,
+  stream_id uuid NOT NULL,
+  stream_status text NOT NULL DEFAULT 'unknown',
+  mode text NOT NULL DEFAULT 'bootstrap',
+  last_verification_at timestamptz,
+  bootstrap_until timestamptz,
+  consecutive_verifications integer NOT NULL DEFAULT 0,
+  pending_state_hash bytea,
+  pending_state_created_at timestamptz,
+  fallback_since timestamptz,
+  last_error_category text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (issuer, audience),
+  UNIQUE (stream_id),
+  CONSTRAINT gateway_security_event_stream_state_mode
+    CHECK (mode IN ('bootstrap','push_healthy','introspection_fallback')),
+  CONSTRAINT gateway_security_event_stream_state_status
+    CHECK (stream_status IN ('unknown','enabled','paused','disabled')),
+  CONSTRAINT gateway_security_event_stream_state_pending_hash
+    CHECK (pending_state_hash IS NULL OR octet_length(pending_state_hash) = 32)
+);
+
+CREATE TABLE IF NOT EXISTS gateway_security_event_verification_challenges (
+  issuer text NOT NULL,
+  audience text NOT NULL,
+  state_hash bytea NOT NULL,
+  created_at timestamptz NOT NULL,
+  expires_at timestamptz NOT NULL,
+  PRIMARY KEY (issuer, audience, state_hash),
+  FOREIGN KEY (issuer, audience)
+    REFERENCES gateway_security_event_stream_state(issuer, audience) ON DELETE CASCADE,
+  CONSTRAINT gateway_security_event_verification_challenge_hash
+    CHECK (octet_length(state_hash) = 32)
+);
+
+CREATE INDEX IF NOT EXISTS idx_gateway_security_event_challenges_expiry
+  ON gateway_security_event_verification_challenges(expires_at);