feat: 将 Gateway Web 迁移到 BFF 会话

浏览器只通过 HttpOnly Cookie 恢复统一认证状态，不再访问认证中心 Token Endpoint 或保存 OIDC Token。同步更新错误提示、部署配置和接入文档。

apps/web/src/lib/oidc-browser-session.ts

@@ -1,10 +1,8 @@
 import {
-  createOIDCBrowserSession,
   GatewayApiError,
   getCurrentUser,
   OIDC_BROWSER_SESSION_CREDENTIAL,
 } from '../api';
-import { persistAccessToken } from './auth-storage';
 
 type CurrentUser = Awaited<ReturnType<typeof getCurrentUser>>;
 
@@ -13,13 +11,6 @@ export interface RestoredOIDCBrowserSession {
   user: CurrentUser;
 }
 
-export async function activateOIDCBrowserSession(accessToken: string) {
-  if (!accessToken.trim()) throw new Error('统一认证未返回 Access Token');
-  await createOIDCBrowserSession(accessToken);
-  persistAccessToken('');
-  return OIDC_BROWSER_SESSION_CREDENTIAL;
-}
-
 export async function restoreOIDCBrowserSession(): Promise<RestoredOIDCBrowserSession | null> {
   try {
     const user = await getCurrentUser(OIDC_BROWSER_SESSION_CREDENTIAL);