feat(identity): 收敛 AI Gateway 统一认证入口

Web 登录页合并为单一统一认证入口，未指定上下文时由认证中心在登录后决策。继续接受旧客户端显式传入 platform 或 tenant，并保持回调上下文及 tenant_hint 的绑定校验。同步更新 OpenAPI 产物。\n\n验证：Go 全量测试与 go vet 通过；Web lint、141 项 Vitest 和生产构建通过；本地 platform.admin 登录及管理工作台访问通过。

apps/web/src/App.tsx

@@ -135,7 +135,6 @@ import {
   loadOIDCRuntimeConfiguration,
   startOIDCLogin,
   startOIDCLogout,
-  type OIDCContextType,
 } from './lib/oidc';
 import { runTask, type RunTaskOptions } from './lib/run-task';
 import { AdminPage } from './pages/AdminPage';
@@ -281,7 +280,6 @@ export function App() {
   const [error, setError] = useState('');
   const [oidcCallbackError, setOIDCCallbackError] = useState(() => consumeOIDCCallbackError());
   const [oidcEnabled, setOIDCEnabled] = useState(false);
-  const [oidcContextTypes, setOIDCContextTypes] = useState<OIDCContextType[]>([]);
   const currentCredentialRef = useRef(token);
   const resetAuthenticatedSessionRef = useRef<() => void>(() => undefined);
   currentCredentialRef.current = token;
@@ -340,7 +338,6 @@ export function App() {
       if (cancelled) return;
       const identityEnabled = configuration.enabled && configuration.oidcLogin;
       setOIDCEnabled(identityEnabled);
-      setOIDCContextTypes(configuration.contextTypes);
       if (force && currentCredentialRef.current === OIDC_BROWSER_SESSION_CREDENTIAL) {
         await reconcileOIDCBrowserSessionAfterRuntimeChange({
           credential: currentCredentialRef.current,
@@ -1307,14 +1304,11 @@ export function App() {
     navigatePath('/');
   }
 
-  function loginWithOIDC(
-    contextType: OIDCContextType =
-      oidcContextTypes.includes('platform') ? 'platform' : 'tenant',
-  ) {
+  function loginWithOIDC() {
     setState('loading');
     setError('');
     setOIDCCallbackError(null);
-    void startOIDCLogin(contextType).catch((err) => {
+    void startOIDCLogin().catch((err) => {
       setState('error');
       setError(err instanceof Error ? err.message : '统一认证登录失败');
     });
@@ -1327,13 +1321,12 @@ export function App() {
       const configuration = await loadOIDCRuntimeConfiguration(true);
       const identityEnabled = configuration.enabled && configuration.oidcLogin;
       setOIDCEnabled(identityEnabled);
-      setOIDCContextTypes(configuration.contextTypes);
       if (
         loginEntryAction(identityEnabled) === 'oidc' &&
         configuration.contextTypes.length === 1
       ) {
         setOIDCCallbackError(null);
-        await startOIDCLogin(configuration.contextTypes[0], configuration);
+        await startOIDCLogin(undefined, configuration);
         return;
       }
       setState('idle');
@@ -1492,7 +1485,6 @@ export function App() {
             onSubmitLogin={submitLogin}
             onSubmitRegister={submitRegister}
             oidcEnabled={oidcEnabled}
-            oidcContextTypes={oidcContextTypes}
             onOIDCLogin={loginWithOIDC}
           />
         )
@@ -1565,7 +1557,6 @@ export function App() {
             onSubmitLogin={submitLogin}
             onSubmitRegister={submitRegister}
             oidcEnabled={oidcEnabled}
-            oidcContextTypes={oidcContextTypes}
             onOIDCLogin={loginWithOIDC}
           />
         )