feat(identity): 实现接入码配对后台流程

Gateway 使用一次性接入码创建 Exchange，将 Exchange Token、机器凭据与 Session Key 仅写入 SecretStore，并持久化脱敏配对进度。\n\n资源就绪后先保存凭据和 Manifest，再自动准备 SSF，最后确认远端 Exchange；SecretStore 失败时保持 ready，重试会触发新 Secret 轮换，不回放旧值。\n\n验证：go test ./...；go vet ./...

apps/api/migrations/0068_identity_onboarding_exchanges.sql

@@ -0,0 +1,23 @@
+ALTER TABLE gateway_identity_configuration_revisions
+  ADD COLUMN IF NOT EXISTS security_event_issuer text,
+  ADD COLUMN IF NOT EXISTS security_event_configuration_url text,
+  ADD COLUMN IF NOT EXISTS security_event_audience text;
+
+CREATE TABLE IF NOT EXISTS gateway_identity_onboarding_exchanges (
+  id uuid PRIMARY KEY,
+  revision_id uuid NOT NULL UNIQUE REFERENCES gateway_identity_configuration_revisions(id) ON DELETE CASCADE,
+  remote_exchange_id uuid NOT NULL UNIQUE,
+  exchange_token_ref text NOT NULL CHECK (exchange_token_ref ~ '^[a-z0-9][a-z0-9-]{0,127}$'),
+  status text NOT NULL CHECK (status IN ('metadata_pending','preparing','ready','credentials_saved','completed','failed','expired')),
+  remote_version bigint NOT NULL CHECK (remote_version > 0),
+  expires_at timestamptz NOT NULL,
+  version bigint NOT NULL DEFAULT 1 CHECK (version > 0),
+  last_error_category text,
+  auth_center_audit_id text,
+  last_trace_id text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_gateway_identity_onboarding_status
+  ON gateway_identity_onboarding_exchanges(status, updated_at DESC);