feat(identity): 接入认证中心多租户登录

支持 Manifest V2 动态 tid 验证、Tenant Context 同步和租户内 JIT 投影，并保留 Manifest V1 与旧 Session 兼容。\n\n增加 tenantHint、租户切换、普通注册关闭及 application/principal/tenant 两级 SSF 撤销；迁移、定向安全测试和本地双租户跨仓 E2E 已通过。\n\nrelease_required=true；未执行 Release、Staging 或真实链路。

apps/api/internal/securityevents/service.go

@@ -26,7 +26,7 @@ type StateRepository interface {
 	BeginSecurityEventVerification(context.Context, string, string, []byte, time.Time) error
 	RecordSecurityEventHeartbeatFailure(context.Context, string, string, string) error
 	AdvanceSecurityEventStreamState(context.Context, string, string, time.Time, time.Duration) error
-	EvaluateOIDCSecurityEvent(context.Context, string, string, string, string, string, time.Time, time.Time, time.Duration) (store.SecurityEventEvaluation, error)
+	EvaluateOIDCSecurityEvent(context.Context, string, string, string, string, string, string, time.Time, time.Time, time.Duration) (store.SecurityEventEvaluation, error)
 }
 
 type ServiceConfig struct {
@@ -95,7 +95,7 @@ func (s *Service) RequestVerification(ctx context.Context) { s.sendVerification(
 
 func (s *Service) Evaluate(ctx context.Context, identity auth.OIDCSecurityEventIdentity) (auth.OIDCSecurityEventEvaluation, error) {
 	result, err := s.repository.EvaluateOIDCSecurityEvent(
-		ctx, s.config.Issuer, s.config.Audience, identity.Issuer, identity.TenantID, identity.Subject,
+		ctx, s.config.Issuer, s.config.Audience, identity.Issuer, identity.ApplicationID, identity.TenantID, identity.Subject,
 		identity.IssuedAt, s.clock().UTC(), s.config.StaleAfter,
 	)
 	if err != nil {