feat(billing): 完成异步结算与请求执行闭环

统一任务成功、Attempt 与结算 Outbox 的事务边界，增加多实例安全结算、人工复核、请求幂等与执行租约。钱包决策使用九位精确金额，并通过审计保护约束保留流水事实；同时补充管理接口、指标与 PostgreSQL 集成测试。

apps/api/internal/httpapi/oidc_jit_integration_test.go

@@ -43,7 +43,7 @@ func TestOIDCJITFullGatewayUserFlowAndSecurityBoundary(t *testing.T) {
 	if err != nil {
 		t.Fatalf("connect store: %v", err)
 	}
-	defer db.Close()
+	t.Cleanup(db.Close)
 
 	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
@@ -247,6 +247,9 @@ DELETE FROM gateway_users WHERE source = 'oidc' AND external_user_id = ANY($1::t
 		t.Fatalf("rejected OIDC tokens created %d local users", rejectedWrites)
 	}
 
+	if _, err := db.DisableActiveIdentityRevision(ctx, activeRevision.Version, "oidc-jit-disabled", "oidc-jit-disabled"); err != nil {
+		t.Fatalf("disable initial OIDC JIT revision: %v", err)
+	}
 	disabledJITRevision := prepareOIDCJITRevision(t, ctx, db, baseConfig, issuer, "default", false)
 	testRevisionIDs = append(testRevisionIDs, disabledJITRevision.ID)
 	disabledJITRevision, _, err = db.ActivateIdentityRevision(ctx, disabledJITRevision.ID, disabledJITRevision.Version, "oidc-jit-disabled", "oidc-jit-disabled")
@@ -298,6 +301,9 @@ func prepareOIDCJITRevision(t *testing.T, ctx context.Context, db *store.Store,
 	if err := secrets.Put(ctx, sessionReference, bytes.Repeat([]byte{8}, 32)); err != nil {
 		t.Fatalf("store OIDC JIT session key: %v", err)
 	}
+	if err := db.QueueIdentitySecretCleanup(ctx, sessionReference, time.Now().Add(10*time.Minute)); err != nil {
+		t.Fatalf("stage OIDC JIT session key for adoption: %v", err)
+	}
 	draft, err = db.ApplyIdentityManifest(ctx, draft.ID, draft.Version, identity.ManifestApplication{
 		Manifest: identity.ManifestV1{
 			SchemaVersion: 1, Issuer: issuer, TenantID: oidcJITTenantID, ApplicationID: uuid.NewString(),
@@ -360,6 +366,10 @@ var currentOIDCTestNonce string
 
 func createOIDCBFFSessionCookie(t *testing.T, baseURL string) *http.Cookie {
 	t.Helper()
+	parsedBaseURL, err := url.Parse(baseURL)
+	if err != nil {
+		t.Fatal(err)
+	}
 	jar, err := cookiejar.New(nil)
 	if err != nil {
 		t.Fatal(err)
@@ -371,6 +381,11 @@ func createOIDCBFFSessionCookie(t *testing.T, baseURL string) *http.Cookie {
 		if len(via) > 10 {
 			return errors.New("too many redirects")
 		}
+		// Follow the synthetic issuer's authorization redirect, then stop before
+		// the callback redirects the browser to the separately hosted web app.
+		if request.URL.Host != parsedBaseURL.Host && request.URL.Path != "/authorize" {
+			return http.ErrUseLastResponse
+		}
 		return nil
 	}}
 	response, err := client.Get(baseURL + "/api/v1/auth/oidc/login?returnTo=%2Fapi%2Fv1%2Fme")
@@ -378,11 +393,10 @@ func createOIDCBFFSessionCookie(t *testing.T, baseURL string) *http.Cookie {
 		t.Fatalf("complete OIDC BFF login: %v", err)
 	}
 	defer response.Body.Close()
-	if response.StatusCode != http.StatusOK {
+	if response.StatusCode != http.StatusOK && response.StatusCode != http.StatusSeeOther {
 		body, _ := io.ReadAll(response.Body)
 		t.Fatalf("OIDC BFF login status = %d, want 200: %s", response.StatusCode, body)
 	}
-	parsedBaseURL, _ := url.Parse(baseURL)
 	for _, cookie := range jar.Cookies(parsedBaseURL) {
 		if cookie.Name == auth.OIDCSessionCookieName {
 			if strings.Count(cookie.Value, ".") == 2 {