chore(merge): 整合最新 main 与统一认证变更

合并远端生产 CI、依赖与 API 文档改动，保留统一认证和 SSF 能力。由于远端生产基线已占用 0062，将尚未发布的身份迁移整理为 0063 至 0068 的最终增量 Schema，移除仅用于开发期草稿升级的破坏性迁移步骤。

验证：go test ./...。其余生产门禁在合并提交后继续执行。

apps/api/migrations/0068_identity_pairing_start_reservation.sql

@@ -0,0 +1,26 @@
+CREATE TABLE IF NOT EXISTS gateway_identity_pairing_start_reservation (
+  singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
+  attempt_id uuid NOT NULL UNIQUE,
+  state text NOT NULL DEFAULT 'starting' CHECK (state IN ('starting','paired')),
+  revision_id uuid UNIQUE REFERENCES gateway_identity_configuration_revisions(id) ON DELETE RESTRICT,
+  expires_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT gateway_identity_pairing_start_state_check CHECK (
+    (state='starting' AND revision_id IS NULL) OR
+    (state='paired' AND revision_id IS NOT NULL)
+  )
+);
+
+CREATE INDEX IF NOT EXISTS idx_gateway_identity_pairing_start_expiry
+  ON gateway_identity_pairing_start_reservation(state, expires_at);
+
+INSERT INTO gateway_identity_pairing_start_reservation(singleton,attempt_id,state,revision_id,expires_at)
+SELECT true,exchange.id,'paired',revision.id,exchange.expires_at
+FROM gateway_identity_configuration_revisions revision
+JOIN gateway_identity_onboarding_exchanges exchange ON exchange.revision_id=revision.id
+WHERE revision.state IN ('draft','validated','failed')
+  AND NOT (exchange.status='cancelled' AND exchange.cleanup_status='completed')
+ORDER BY revision.created_at DESC,exchange.created_at DESC
+LIMIT 1
+ON CONFLICT DO NOTHING;