feat(identity): 接入认证中心多租户登录

支持 Manifest V2 动态 tid 验证、Tenant Context 同步和租户内 JIT 投影，并保留 Manifest V1 与旧 Session 兼容。\n\n增加 tenantHint、租户切换、普通注册关闭及 application/principal/tenant 两级 SSF 撤销；迁移、定向安全测试和本地双租户跨仓 E2E 已通过。\n\nrelease_required=true；未执行 Release、Staging 或真实链路。

apps/api/internal/httpapi/handlers_identity_test.go

@@ -0,0 +1,41 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/config"
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/identity"
+)
+
+func TestRegisterIsStructurallyForbiddenWhenIdentityRevisionIsActive(t *testing.T) {
+	server := &Server{
+		cfg: config.Config{IdentityMode: "hybrid"},
+		identityTestRevision: identity.Revision{
+			State: identity.RevisionActive, Issuer: "https://auth.example.test",
+			LegacyJWTEnabled: true,
+		},
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/v1/auth/register", strings.NewReader(`{}`))
+	recorder := httptest.NewRecorder()
+
+	server.register(recorder, request)
+
+	if recorder.Code != http.StatusForbidden {
+		t.Fatalf("status=%d, want 403", recorder.Code)
+	}
+	var envelope struct {
+		Error struct {
+			Code string `json:"code"`
+		} `json:"error"`
+	}
+	if err := json.Unmarshal(recorder.Body.Bytes(), &envelope); err != nil {
+		t.Fatal(err)
+	}
+	if envelope.Error.Code != "LOCAL_REGISTRATION_DISABLED" {
+		t.Fatalf("code=%q", envelope.Error.Code)
+	}
+}