feat(identity): 实现接入码配对后台流程

Gateway 使用一次性接入码创建 Exchange，将 Exchange Token、机器凭据与 Session Key 仅写入 SecretStore，并持久化脱敏配对进度。\n\n资源就绪后先保存凭据和 Manifest，再自动准备 SSF，最后确认远端 Exchange；SecretStore 失败时保持 ready，重试会触发新 Secret 轮换，不回放旧值。\n\n验证：go test ./...；go vet ./...

apps/api/internal/identity/configuration.go

@@ -48,6 +48,9 @@ type Revision struct {
 	LegacyJWTEnabled        bool          `json:"legacyJwtEnabled"`
 	TokenIntrospection      bool          `json:"tokenIntrospection"`
 	SessionRevocation       bool          `json:"sessionRevocation"`
+	SecurityEventIssuer     string        `json:"securityEventIssuer,omitempty"`
+	SecurityEventConfigURL  string        `json:"securityEventConfigurationUrl,omitempty"`
+	SecurityEventAudience   string        `json:"securityEventAudience,omitempty"`
 	MachineCredentialRef    string        `json:"-"`
 	SessionEncryptionKeyRef string        `json:"-"`
 	SessionIdleSeconds      int           `json:"sessionIdleSeconds"`
@@ -136,6 +139,11 @@ func ApplyManifest(revision Revision, input ManifestApplication) (Revision, erro
 	}
 	revision.TokenIntrospection = capabilities["token_introspection"]
 	revision.SessionRevocation = capabilities["session_revocation"]
+	if input.Manifest.SecurityEvents != nil {
+		revision.SecurityEventIssuer = input.Manifest.SecurityEvents.TransmitterIssuer
+		revision.SecurityEventConfigURL = input.Manifest.SecurityEvents.ConfigurationEndpoint
+		revision.SecurityEventAudience = input.Manifest.SecurityEvents.Audience
+	}
 	revision.MachineCredentialRef = strings.TrimSpace(input.MachineCredentialRef)
 	revision.SessionEncryptionKeyRef = strings.TrimSpace(input.SessionEncryptionKeyRef)
 	revision.LastTraceID = strings.TrimSpace(input.TraceID)