feat(ssf): 实现安全事件一键连接与凭据托管

新增数据库驱动的 SecurityEventConnectionManager，复用 RFC 7662 机器 Client，自动完成 Discovery、Push Bearer 生成、Stream 创建、Verification、首次启用、零停机轮换和安全退役。

增加文件与 Kubernetes SecretStore、最小权限 RBAC、动态 Receiver/撤销水位/内省降级，以及系统设置管理页面。已通过全量 Go 测试、go vet、关键包竞态测试、27 个 Web 测试、类型检查、生产构建、Compose 和 Kubernetes dry-run。

apps/api/internal/securityevents/metrics.go

@@ -2,16 +2,24 @@ package securityevents
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"sync/atomic"
 	"time"
+
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
 )
 
 type MetricsSnapshotProvider interface {
 	SecurityEventMetrics(context.Context, string, string) (string, *time.Time, error)
 }
 
+type DynamicMetricsSnapshotProvider interface {
+	MetricsSnapshotProvider
+	SecurityEventConnection(context.Context) (store.SecurityEventConnection, error)
+}
+
 type Metrics struct {
 	accepted              atomic.Uint64
 	rejected              atomic.Uint64
@@ -151,6 +159,25 @@ func (m *Metrics) Handler(provider MetricsSnapshotProvider, issuer, audience str
 	})
 }
 
+func (m *Metrics) DynamicHandler(provider DynamicMetricsSnapshotProvider) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		connection, err := provider.SecurityEventConnection(r.Context())
+		if errors.Is(err, store.ErrSecurityEventConnectionNotFound) {
+			m.Handler(provider, "", "", false).ServeHTTP(w, r)
+			return
+		}
+		if err != nil {
+			http.Error(w, "metrics unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		if connection.Audience == nil {
+			m.Handler(provider, "", "", false).ServeHTTP(w, r)
+			return
+		}
+		m.Handler(provider, connection.TransmitterIssuer, *connection.Audience, true).ServeHTTP(w, r)
+	})
+}
+
 type outcomeValue struct {
 	name  string
 	value uint64