feat(identity): 接入认证中心多租户登录

支持 Manifest V2 动态 tid 验证、Tenant Context 同步和租户内 JIT 投影，并保留 Manifest V1 与旧 Session 兼容。\n\n增加 tenantHint、租户切换、普通注册关闭及 application/principal/tenant 两级 SSF 撤销；迁移、定向安全测试和本地双租户跨仓 E2E 已通过。\n\nrelease_required=true；未执行 Release、Staging 或真实链路。

apps/api/internal/auth/oidc_client_test.go

@@ -67,7 +67,8 @@ func TestOIDCPublicClientUsesAuthorizationCodePKCES256WithoutSecret(t *testing.T
 	if err := client.ValidateConfiguration(context.Background()); err != nil {
 		t.Fatalf("ValidateConfiguration() error = %v", err)
 	}
-	authorizationURL, err := client.AuthorizationURL(context.Background(), "state", "nonce", pkceVerifier)
+	tenantHint := "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
+	authorizationURL, err := client.AuthorizationURL(context.Background(), "state", "nonce", pkceVerifier, tenantHint)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -78,6 +79,9 @@ func TestOIDCPublicClientUsesAuthorizationCodePKCES256WithoutSecret(t *testing.T
 	if query.Get("response_type") != "code" || query.Get("code_challenge_method") != "S256" || query.Get("code_challenge") != expectedChallenge {
 		t.Fatalf("authorization request is not PKCE S256: %v", query)
 	}
+	if query.Get("tenant_hint") != tenantHint {
+		t.Fatalf("tenant_hint = %q, want %q", query.Get("tenant_hint"), tenantHint)
+	}
 	if _, err := client.ExchangeCode(context.Background(), "authorization-code", pkceVerifier); err != nil {
 		t.Fatal(err)
 	}