feat(ssf): 实现安全事件一键连接与凭据托管

新增数据库驱动的 SecurityEventConnectionManager，复用 RFC 7662 机器 Client，自动完成 Discovery、Push Bearer 生成、Stream 创建、Verification、首次启用、零停机轮换和安全退役。

增加文件与 Kubernetes SecretStore、最小权限 RBAC、动态 Receiver/撤销水位/内省降级，以及系统设置管理页面。已通过全量 Go 测试、go vet、关键包竞态测试、27 个 Web 测试、类型检查、生产构建、Compose 和 Kubernetes dry-run。

apps/api/internal/auth/oidc.go

@@ -48,6 +48,7 @@ type OIDCSecurityEventIdentity struct {
 }
 
 type OIDCSecurityEventEvaluation struct {
+	Enabled              bool
 	Revoked              bool
 	RequireIntrospection bool
 }
@@ -91,7 +92,7 @@ func NewOIDCVerifier(config OIDCConfig) (*OIDCVerifier, error) {
 	if err := validatePublicURL(config.Issuer); err != nil || config.Audience == "" || config.TenantID == "" || config.RolePrefix == "" {
 		return nil, errors.New("issuer, audience, tenant and role prefix are required")
 	}
-	if (config.IntrospectionEnabled || config.SecurityEventEvaluator != nil) && (strings.TrimSpace(config.IntrospectionClientID) == "" || config.IntrospectionClientSecret == "") {
+	if config.IntrospectionEnabled && (strings.TrimSpace(config.IntrospectionClientID) == "" || config.IntrospectionClientSecret == "") {
 		return nil, errors.New("introspection client credentials are required when introspection is enabled")
 	}
 	if config.JWKSCacheTTL <= 0 {
@@ -145,9 +146,6 @@ func (v *OIDCVerifier) Verify(ctx context.Context, raw string) (*User, error) {
 		return nil, oidcUnauthorized("nbf is missing", nil)
 	}
 	issuedAt, hasIssuedAt := numericDateClaim(claims["iat"])
-	if v.config.SecurityEventEvaluator != nil && !hasIssuedAt {
-		return nil, oidcUnauthorized("iat is required when security events are enabled", nil)
-	}
 	scopes := scopeClaims(claims)
 	if !containsAll(scopes, v.config.RequiredScopes) {
 		return nil, oidcUnauthorized("required scope is missing", nil)
@@ -166,6 +164,9 @@ func (v *OIDCVerifier) Verify(ctx context.Context, raw string) (*User, error) {
 		if evaluateErr != nil {
 			return nil, NewRequestAuthError(http.StatusServiceUnavailable, "OIDC_SECURITY_EVENT_STATE_UNAVAILABLE", "认证撤销状态暂时不可用")
 		}
+		if evaluation.Enabled && !hasIssuedAt {
+			return nil, oidcUnauthorized("iat is required when security events are enabled", nil)
+		}
 		if evaluation.Revoked {
 			return nil, oidcUnauthorized("token was issued before the revocation watermark", nil)
 		}
@@ -177,6 +178,11 @@ func (v *OIDCVerifier) Verify(ctx context.Context, raw string) (*User, error) {
 			if !active {
 				return nil, oidcUnauthorized("token is inactive", nil)
 			}
+		} else if !evaluation.Enabled && v.config.IntrospectionEnabled {
+			active, introspectionErr := v.introspect(ctx, raw)
+			if introspectionErr != nil || !active {
+				return nil, oidcUnauthorized("token is inactive", introspectionErr)
+			}
 		}
 	} else if v.config.IntrospectionEnabled {
 		active, err := v.introspect(ctx, raw)