chore(merge): 整合最新 main 与统一认证变更

合并远端生产 CI、依赖与 API 文档改动，保留统一认证和 SSF 能力。由于远端生产基线已占用 0062，将尚未发布的身份迁移整理为 0063 至 0068 的最终增量 Schema，移除仅用于开发期草稿升级的破坏性迁移步骤。

验证：go test ./...。其余生产门禁在合并提交后继续执行。

apps/api/migrations/0064_security_event_connections.sql

@@ -0,0 +1,46 @@
+CREATE TABLE IF NOT EXISTS gateway_security_event_connections (
+  connection_id uuid PRIMARY KEY,
+  singleton boolean NOT NULL DEFAULT true UNIQUE CHECK (singleton),
+  transmitter_issuer text NOT NULL,
+  endpoint_url text NOT NULL,
+  audience text,
+  stream_id uuid,
+  credential_ref text NOT NULL,
+  next_credential_ref text,
+  management_client_id text,
+  management_credential_ref text,
+  lifecycle_status text NOT NULL,
+  version bigint NOT NULL DEFAULT 1,
+  last_error_category text,
+  idempotency_key text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT gateway_security_event_connection_status CHECK (lifecycle_status IN (
+    'connecting','verifying','bootstrap','enabled','degraded','rotating',
+    'disconnect_pending','retiring','error'
+  )),
+  CONSTRAINT gateway_security_event_connection_stream_pair CHECK (
+    (audience IS NULL AND stream_id IS NULL) OR (audience IS NOT NULL AND stream_id IS NOT NULL)
+  ),
+  CONSTRAINT gateway_security_event_management_credential_pair CHECK (
+    (management_client_id IS NULL AND management_credential_ref IS NULL) OR
+    (management_client_id IS NOT NULL AND management_credential_ref IS NOT NULL)
+  )
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_gateway_security_event_connections_idempotency
+  ON gateway_security_event_connections(idempotency_key);
+
+CREATE TABLE IF NOT EXISTS gateway_security_event_connection_idempotency (
+  operation text NOT NULL,
+  idempotency_key text NOT NULL,
+  request_hash text NOT NULL,
+  response jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (operation, idempotency_key),
+  CONSTRAINT gateway_security_event_connection_idempotency_operation
+    CHECK (operation IN ('connect','verify','rotate','disconnect'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_gateway_security_event_connection_idempotency_created
+  ON gateway_security_event_connection_idempotency(created_at);