feat: 将 Gateway Web 迁移到 BFF 会话

浏览器只通过 HttpOnly Cookie 恢复统一认证状态，不再访问认证中心 Token Endpoint 或保存 OIDC Token。同步更新错误提示、部署配置和接入文档。

apps/web/src/lib/oidc-browser-session.test.ts

@@ -1,31 +1,8 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import { OIDC_BROWSER_SESSION_CREDENTIAL } from '../api';
-import { activateOIDCBrowserSession, restoreOIDCBrowserSession } from './oidc-browser-session';
-
-class MemoryStorage {
-  private values = new Map<string, string>();
-  getItem(key: string) { return this.values.get(key) ?? null; }
-  setItem(key: string, value: string) { this.values.set(key, value); }
-  removeItem(key: string) { this.values.delete(key); }
-}
+import { restoreOIDCBrowserSession } from './oidc-browser-session';
 
 describe('OIDC browser session lifecycle', () => {
-  beforeEach(() => {
-    vi.stubGlobal('window', { localStorage: new MemoryStorage(), sessionStorage: new MemoryStorage() });
-  });
-
-  it('moves an OIDC access token into the HttpOnly session and clears browser token storage', async () => {
-    window.localStorage.setItem('easyai_ai_gateway_access_token', 'old-local-token');
-    window.sessionStorage.setItem('easyai_ai_gateway_oidc_access_token', 'old-oidc-token');
-    vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response(null, { status: 204 })));
-
-    const credential = await activateOIDCBrowserSession('new-oidc-token');
-
-    expect(credential).toBe(OIDC_BROWSER_SESSION_CREDENTIAL);
-    expect(window.localStorage.getItem('easyai_ai_gateway_access_token')).toBeNull();
-    expect(window.sessionStorage.getItem('easyai_ai_gateway_oidc_access_token')).toBeNull();
-  });
-
   it('restores a shared cookie session in a fresh tab', async () => {
     vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response(JSON.stringify({
       sub: 'platform-user', source: 'oidc', gatewayUserId: 'gateway-user',