test(identity): 禁止 Gateway 依赖认证内核语义

将 OIDC 与安全事件集成测试中的 Realm 风格 Issuer 收敛为稳定 Issuer，并增加扫描所有 Gateway 已跟踪源码类别的回归门禁，避免 Keycloak 或 Realm URL 成为消费方契约。\n\n验证：go vet ./...；go test -race ./... -count=1；go test ./... -count=1；govulncheck ./...。

apps/api/internal/store/oidc_users_integration_test.go

@@ -31,7 +31,7 @@ func TestResolveOrProvisionOIDCUserLifecycleAndConcurrency(t *testing.T) {
 	suffix := time.Now().UTC().Format("20060102150405.000000000")
 	subject := "platform-jit-" + suffix
 	input := ResolveOrProvisionOIDCUserInput{
-		Issuer:              "https://auth.test.example/realms/easyai",
+		Issuer:              "https://auth.test.example/issuer/shared",
 		Subject:             subject,
 		Username:            "jit-user-" + suffix,
 		Roles:               []string{"basic"},
@@ -176,7 +176,7 @@ func TestResolveOrProvisionOIDCUserRejectsMissingMappingWithoutWrites(t *testing
 
 	subject := "platform-jit-missing-" + time.Now().UTC().Format("20060102150405.000000000")
 	input := ResolveOrProvisionOIDCUserInput{
-		Issuer:           "https://auth.test.example/realms/easyai",
+		Issuer:           "https://auth.test.example/issuer/shared",
 		Subject:          subject,
 		Username:         "missing-user",
 		Roles:            []string{"basic"},
@@ -239,7 +239,7 @@ RETURNING id::text`, tenantKey, groupID).Scan(&tenantID); err != nil {
 }
 
 func TestOIDCUserKeyIsStableAndDoesNotExposeClaims(t *testing.T) {
-	issuer := "https://auth.test.example/realms/easyai"
+	issuer := "https://auth.test.example/issuer/shared"
 	subject := "platform-sensitive-subject"
 	first := deriveOIDCUserKey(issuer, subject)
 	second := deriveOIDCUserKey(issuer+"/", subject)