fix: 为失效 OIDC 事务提供安全重试

细分回调事务、状态和授权响应错误，提供脱敏诊断编号与显式重新登录入口，避免失效事务形成重试循环。

apps/web/src/App.tsx

@@ -108,6 +108,7 @@ import {
 import type { ConsoleData, StatItem } from './app-state';
 import { AppShell } from './components/layout/AppShell';
 import { LoginRequiredPanel } from './components/LoginRequiredPanel';
+import { OIDCCallbackNotice } from './components/OIDCCallbackNotice';
 import { useCatalogOperations } from './hooks/useCatalogOperations';
 import { usePricingRuleSetOperations } from './hooks/usePricingRuleSetOperations';
 import { useRuntimePolicySetOperations } from './hooks/useRuntimePolicySetOperations';
@@ -306,7 +307,7 @@ export function App() {
     };
   }, [oidcCallbackError]);
   useEffect(() => {
-    if (token) setOIDCCallbackError('');
+    if (token) setOIDCCallbackError(null);
   }, [token]);
   useEffect(() => {
     void ensureData(['health']);
@@ -1152,7 +1153,7 @@ export function App() {
   function loginWithOIDC() {
     setState('loading');
     setError('');
-    setOIDCCallbackError('');
+    setOIDCCallbackError(null);
     void startOIDCLogin().catch((err) => {
       setState('error');
       setError(err instanceof Error ? err.message : '统一认证登录失败');
@@ -1231,7 +1232,11 @@ export function App() {
       onRefresh={() => void refresh()}
       onSignOut={signOut}
     >
-      {(oidcCallbackError || error) && <div className="notice">{oidcCallbackError || error}</div>}
+      {oidcCallbackError ? (
+        <OIDCCallbackNotice error={oidcCallbackError} onRetry={loginWithOIDC} />
+      ) : error ? (
+        <div className="notice">{error}</div>
+      ) : null}
       {activePage === 'home' && <HomePage onNavigate={navigatePage} onPlaygroundMode={navigatePlaygroundMode} />}
       {activePage === 'playground' && (
         <PlaygroundPage