feat(identity): 接入认证中心多租户登录

支持 Manifest V2 动态 tid 验证、Tenant Context 同步和租户内 JIT 投影，并保留 Manifest V1 与旧 Session 兼容。\n\n增加 tenantHint、租户切换、普通注册关闭及 application/principal/tenant 两级 SSF 撤销；迁移、定向安全测试和本地双租户跨仓 E2E 已通过。\n\nrelease_required=true；未执行 Release、Staging 或真实链路。

apps/api/internal/identityruntime/manager.go

@@ -40,11 +40,20 @@ type Runtime struct {
 	Sessions                  *oidcsession.Service
 	SessionCipher             *oidcsession.Cipher
 	SecurityEvents            *securityevents.ConnectionManager
+	TenantContext             *identity.TenantContextClient
 	CookieSecure              bool
 	close                     func()
+	start                     func()
+	startOnce                 sync.Once
 	securityEventDisconnector SecurityEventDisconnector
 }
 
+func (runtime *Runtime) Start() {
+	if runtime != nil && runtime.start != nil {
+		runtime.startOnce.Do(runtime.start)
+	}
+}
+
 func (runtime *Runtime) Close() {
 	if runtime != nil && runtime.close != nil {
 		runtime.close()
@@ -378,6 +387,7 @@ func (manager *Manager) publishRuntime(candidate *Runtime, revision identity.Rev
 	manager.rememberTrustedWebBaseURL(revision.WebBaseURL)
 	manager.legacyJWTAllowed.Store(revision.LegacyJWTEnabled)
 	old := manager.current.Swap(candidate)
+	candidate.Start()
 	manager.adoptPreparedSecurityEvents(candidate, revision.ID)
 	manager.reconciliationRequired.Store(false)
 	retireRuntime(old)