fix(identity): 避免未配置 SSF 时触发空指针

SecurityEventReceiver 不再把空 ConnectionManager 包装为非空接口；未启用 SSF 时公开端点明确返回 404。补充运行时和 HTTP 回归测试。\n\n验证：go test ./internal/identityruntime ./internal/httpapi。

apps/api/internal/identityruntime/manager.go

@@ -105,7 +105,10 @@ func (manager *Manager) SecurityEventReceiver() http.Handler {
 	if runtime := manager.Current(); runtime != nil && runtime.SecurityEvents != nil {
 		return runtime.SecurityEvents
 	}
-	return manager.SecurityEventManager()
+	if securityEventManager := manager.SecurityEventManager(); securityEventManager != nil {
+		return securityEventManager
+	}
+	return nil
 }
 
 // SecurityEventManager resolves the manager used by administrative recovery