test(identity): 禁止 Gateway 依赖认证内核语义

将 OIDC 与安全事件集成测试中的 Realm 风格 Issuer 收敛为稳定 Issuer，并增加扫描所有 Gateway 已跟踪源码类别的回归门禁，避免 Keycloak 或 Realm URL 成为消费方契约。\n\n验证：go vet ./...；go test -race ./... -count=1；go test ./... -count=1；govulncheck ./...。

apps/api/internal/store/security_events_integration_test.go

@@ -38,7 +38,7 @@ func TestSecurityEventWatermarkVerificationAndFallbackLifecycle(t *testing.T) {
 	}
 	defer db.Close()
 	issuer := "https://auth.test.example/ssf"
-	subjectIssuer := "https://auth.test/realms/tenant"
+	subjectIssuer := "https://auth.test/issuer/shared"
 	audience := "urn:easyai:ssf:receiver:" + uuid.NewString()
 	streamID, tenantID, subject := uuid.NewString(), uuid.NewString(), uuid.NewString()
 	t.Cleanup(func() {