feat(identity): 接入认证中心多租户登录

支持 Manifest V2 动态 tid 验证、Tenant Context 同步和租户内 JIT 投影，并保留 Manifest V1 与旧 Session 兼容。\n\n增加 tenantHint、租户切换、普通注册关闭及 application/principal/tenant 两级 SSF 撤销；迁移、定向安全测试和本地双租户跨仓 E2E 已通过。\n\nrelease_required=true；未执行 Release、Staging 或真实链路。

apps/api/internal/httpapi/handlers.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/auth"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/clients"
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/identity"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/netproxy"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/runner"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
@@ -90,8 +91,8 @@ func (s *Server) me(w http.ResponseWriter, r *http.Request) {
 // @Failure 500 {object} ErrorEnvelope
 // @Router /api/v1/auth/register [post]
 func (s *Server) register(w http.ResponseWriter, r *http.Request) {
-	if !s.localIdentityEnabled() || !s.ordinaryLocalJWTEnabled() {
-		writeError(w, http.StatusForbidden, "local registration is disabled")
+	if !s.localRegistrationEnabled() {
+		writeError(w, http.StatusForbidden, "统一认证启用后，本地注册已关闭", "LOCAL_REGISTRATION_DISABLED")
 		return
 	}
 	var input store.LocalRegisterInput
@@ -185,6 +186,12 @@ func (s *Server) localIdentityEnabled() bool {
 	return mode == "" || mode == "standalone" || mode == "hybrid"
 }
 
+func (s *Server) localRegistrationEnabled() bool {
+	runtime := s.currentIdentityRuntime()
+	return (runtime == nil || runtime.Revision.State != identity.RevisionActive) &&
+		s.localIdentityEnabled() && s.ordinaryLocalJWTEnabled()
+}
+
 func (s *Server) localLoginAllowed(user store.GatewayUser) bool {
 	for _, role := range user.Roles {
 		if role == "manager" || role == "admin" {