feat: 将 Gateway Web 迁移到 BFF 会话

浏览器只通过 HttpOnly Cookie 恢复统一认证状态，不再访问认证中心 Token Endpoint 或保存 OIDC Token。同步更新错误提示、部署配置和接入文档。

.env.example

@@ -42,9 +42,19 @@ OIDC_GATEWAY_TENANT_KEY=
 OIDC_BROWSER_SESSION_ENABLED=true
 # Staging/production must use true. Local HTTP development may use false.
 OIDC_SESSION_COOKIE_SECURE=false
+# Public Client ID generated by Auth Center Control Plane. No Client Secret is used.
 OIDC_CLIENT_ID=
-OIDC_REDIRECT_URI=http://localhost:5178/auth/callback
+OIDC_REDIRECT_URI=http://localhost:8088/api/v1/auth/oidc/callback
+OIDC_POST_LOGOUT_REDIRECT_URI=http://localhost:5178/
+# Generate a dedicated value with: openssl rand -base64 32
+# Keep the real value only in a Git-ignored local file or Secret Manager.
+OIDC_SESSION_ENCRYPTION_KEY=
+OIDC_SESSION_IDLE_TTL_SECONDS=1800
+OIDC_SESSION_ABSOLUTE_TTL_SECONDS=28800
+OIDC_SESSION_REFRESH_BEFORE_SECONDS=60
 VITE_OIDC_BROWSER_SESSION_ENABLED=true
+VITE_OIDC_ENABLED=false
+AI_GATEWAY_WEB_BASE_URL=http://localhost:5178
 AI_GATEWAY_WEB_BASE_PATH=/
 AI_GATEWAY_GO_BUILD_IMAGE=golang:1.26.3-alpine
 AI_GATEWAY_API_RUNTIME_IMAGE=alpine:3.22