feat(identity): 接入认证中心多租户登录

支持 Manifest V2 动态 tid 验证、Tenant Context 同步和租户内 JIT 投影，并保留 Manifest V1 与旧 Session 兼容。\n\n增加 tenantHint、租户切换、普通注册关闭及 application/principal/tenant 两级 SSF 撤销；迁移、定向安全测试和本地双租户跨仓 E2E 已通过。\n\nrelease_required=true；未执行 Release、Staging 或真实链路。

apps/api/internal/httpapi/identity_runtime.go

@@ -15,6 +15,10 @@ type oidcTokenVerifier interface {
 	Verify(context.Context, string) (*auth.User, error)
 }
 
+type tenantContextReader interface {
+	Get(context.Context, string, string) (identity.TenantContext, bool, error)
+}
+
 // identityRequestRuntime is an immutable request-level snapshot. A handler that
 // starts with one runtime keeps using it even when an administrator activates a
 // new revision while that request is in flight.
@@ -25,6 +29,7 @@ type identityRequestRuntime struct {
 	Sessions       oidcSessionManager
 	SessionCipher  *oidcsession.Cipher
 	SecurityEvents *ssfreceiver.ConnectionManager
+	TenantContext  tenantContextReader
 	CookieSecure   bool
 	BrowserEnabled bool
 }
@@ -38,7 +43,8 @@ func (s *Server) currentIdentityRuntime() *identityRequestRuntime {
 		return &identityRequestRuntime{
 			Revision: runtime.Revision, Verifier: runtime.Verifier, PublicClient: runtime.PublicClient,
 			Sessions: runtime.Sessions, SessionCipher: runtime.SessionCipher, SecurityEvents: runtime.SecurityEvents,
-			CookieSecure: runtime.CookieSecure, BrowserEnabled: runtime.PublicClient != nil,
+			TenantContext: runtime.TenantContext,
+			CookieSecure:  runtime.CookieSecure, BrowserEnabled: runtime.PublicClient != nil,
 		}
 	}