feat(identity): 实现接入码配对后台流程

Gateway 使用一次性接入码创建 Exchange，将 Exchange Token、机器凭据与 Session Key 仅写入 SecretStore，并持久化脱敏配对进度。\n\n资源就绪后先保存凭据和 Manifest，再自动准备 SSF，最后确认远端 Exchange；SecretStore 失败时保持 ready，重试会触发新 Secret 轮换，不回放旧值。\n\n验证：go test ./...；go vet ./...

apps/api/cmd/migrate/main_test.go

@@ -63,3 +63,25 @@ func TestIdentityConfigurationRevisionMigrationDefinesSecretReferencesAndSingleA
 		}
 	}
 }
+
+func TestIdentityOnboardingExchangeMigrationStoresOnlySecretReferences(t *testing.T) {
+	payload, err := os.ReadFile("../../migrations/0068_identity_onboarding_exchanges.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	content := strings.ToLower(string(payload))
+	for _, required := range []string{
+		"create table if not exists gateway_identity_onboarding_exchanges",
+		"exchange_token_ref text not null",
+		"security_event_configuration_url text",
+	} {
+		if !strings.Contains(content, required) {
+			t.Fatalf("identity onboarding migration is missing %q", required)
+		}
+	}
+	for _, forbidden := range []string{"exchange_token text", "onboarding_code", "client_secret", "machine_secret"} {
+		if strings.Contains(content, forbidden) {
+			t.Fatalf("identity onboarding migration stores forbidden secret field %q", forbidden)
+		}
+	}
+}