feat(ssf): 实现安全事件一键连接与凭据托管

新增数据库驱动的 SecurityEventConnectionManager，复用 RFC 7662 机器 Client，自动完成 Discovery、Push Bearer 生成、Stream 创建、Verification、首次启用、零停机轮换和安全退役。

增加文件与 Kubernetes SecretStore、最小权限 RBAC、动态 Receiver/撤销水位/内省降级，以及系统设置管理页面。已通过全量 Go 测试、go vet、关键包竞态测试、27 个 Web 测试、类型检查、生产构建、Compose 和 Kubernetes dry-run。

apps/web/src/pages/admin/SystemSettingsPanel.tsx

@@ -1,10 +1,10 @@
 import { useEffect, useState, type FormEvent } from 'react';
-import { Database, Pencil, Plus, RotateCcw, Save, ServerCog, Settings2, Trash2 } from 'lucide-react';
-import type { ClientCustomizationSettings, ClientCustomizationSettingsUpdateRequest, FileStorageChannel, FileStorageChannelUpsertRequest, FileStorageSettings, FileStorageSettingsUpdateRequest } from '@easyai-ai-gateway/contracts';
+import { Database, Link2, Pencil, Plus, RefreshCw, RotateCcw, Save, ServerCog, Settings2, ShieldCheck, Trash2, Unplug } from 'lucide-react';
+import type { ClientCustomizationSettings, ClientCustomizationSettingsUpdateRequest, FileStorageChannel, FileStorageChannelUpsertRequest, FileStorageSettings, FileStorageSettingsUpdateRequest, SecurityEventConnectionResponse } from '@easyai-ai-gateway/contracts';
 import { Badge, Button, Card, CardContent, CardHeader, CardTitle, ConfirmDialog, FormDialog, Input, Label, Select, Tabs, Textarea } from '../../components/ui';
 import type { LoadState } from '../../types';
 
-type SystemSettingsTab = 'fileStorage' | 'clientCustomization';
+type SystemSettingsTab = 'fileStorage' | 'clientCustomization' | 'securityEvents';
 
 type ClientCustomizationForm = {
   clientEnglishName: string;
@@ -58,11 +58,17 @@ export function SystemSettingsPanel(props: {
   clientCustomizationSettings: ClientCustomizationSettings | null;
   message: string;
   settings: FileStorageSettings | null;
+  securityEventConnection: SecurityEventConnectionResponse | null;
   state: LoadState;
   onDeleteFileStorageChannel: (channelId: string) => Promise<void>;
   onSaveClientCustomizationSettings: (input: ClientCustomizationSettingsUpdateRequest) => Promise<void>;
   onSaveFileStorageChannel: (input: FileStorageChannelUpsertRequest, channelId?: string) => Promise<void>;
   onSaveFileStorageSettings: (input: FileStorageSettingsUpdateRequest) => Promise<void>;
+  onConnectSecurityEvents: (transmitterIssuer: string) => Promise<void>;
+  onDisconnectSecurityEvents: () => Promise<void>;
+  onRefreshSecurityEvents: () => Promise<void>;
+  onRotateSecurityEventsCredential: () => Promise<void>;
+  onVerifySecurityEvents: () => Promise<void>;
 }) {
   const [activeTab, setActiveTab] = useState<SystemSettingsTab>('fileStorage');
   const [dialogOpen, setDialogOpen] = useState(false);
@@ -72,6 +78,8 @@ export function SystemSettingsPanel(props: {
   const [clientCustomizationForm, setClientCustomizationForm] = useState<ClientCustomizationForm>(() => clientCustomizationSettingsToForm(props.clientCustomizationSettings));
   const [settingsPolicy, setSettingsPolicy] = useState(() => normalizeResultUploadPolicy(props.settings?.resultUploadPolicy));
   const [localError, setLocalError] = useState('');
+  const [transmitterIssuer, setTransmitterIssuer] = useState('https://auth.51easyai.com/ssf');
+  const [disconnectOpen, setDisconnectOpen] = useState(false);
 
   useEffect(() => {
     setSettingsPolicy(normalizeResultUploadPolicy(props.settings?.resultUploadPolicy));
@@ -81,6 +89,13 @@ export function SystemSettingsPanel(props: {
     setClientCustomizationForm(clientCustomizationSettingsToForm(props.clientCustomizationSettings));
   }, [props.clientCustomizationSettings]);
 
+  useEffect(() => {
+    const lifecycle = props.securityEventConnection?.connection?.lifecycleStatus;
+    if (!['connecting', 'verifying', 'bootstrap', 'rotating', 'disconnect_pending', 'retiring'].includes(lifecycle ?? '')) return undefined;
+    const timer = window.setInterval(() => { void props.onRefreshSecurityEvents(); }, 2000);
+    return () => window.clearInterval(timer);
+  }, [props.securityEventConnection?.connection?.lifecycleStatus, props.onRefreshSecurityEvents]);
+
   function openCreateDialog() {
     setEditingChannel(null);
     setForm(defaultChannelForm(`server-main-${Date.now().toString(36)}`));
@@ -162,6 +177,7 @@ export function SystemSettingsPanel(props: {
             tabs={[
               { value: 'fileStorage', label: '文件存储', icon: <Database size={15} /> },
               { value: 'clientCustomization', label: '客户端自定义', icon: <Settings2 size={15} /> },
+              { value: 'securityEvents', label: '认证中心安全事件', icon: <ShieldCheck size={15} /> },
             ]}
             onValueChange={setActiveTab}
           />
@@ -275,6 +291,20 @@ export function SystemSettingsPanel(props: {
         </section>
       )}
 
+      {activeTab === 'securityEvents' && (
+        <SecurityEventConnectionPanel
+          connection={props.securityEventConnection}
+          issuer={transmitterIssuer}
+          loading={props.state === 'loading'}
+          onIssuerChange={setTransmitterIssuer}
+          onConnect={props.onConnectSecurityEvents}
+          onDisconnect={() => setDisconnectOpen(true)}
+          onRefresh={props.onRefreshSecurityEvents}
+          onRotate={props.onRotateSecurityEventsCredential}
+          onVerify={props.onVerifySecurityEvents}
+        />
+      )}
+
       <FormDialog
         ariaLabel={editingChannel ? '编辑文件存储渠道' : '新增文件存储渠道'}
         bodyClassName="fileStorageDialogBody"
@@ -363,10 +393,106 @@ export function SystemSettingsPanel(props: {
         onCancel={() => setPendingDeleteChannel(null)}
         onConfirm={() => pendingDeleteChannel ? deleteChannel(pendingDeleteChannel) : undefined}
       />
+      <ConfirmDialog
+        confirmLabel="断开连接"
+        description="系统会先删除远端 Stream，并继续使用水位和 RFC 7662 至少 360 秒；不会让旧 Token 因断开而重新有效。"
+        loading={props.state === 'loading'}
+        open={disconnectOpen}
+        title="确认断开认证中心安全事件连接？"
+        onCancel={() => setDisconnectOpen(false)}
+        onConfirm={async () => { await props.onDisconnectSecurityEvents(); setDisconnectOpen(false); }}
+      />
     </div>
   );
 }
 
+function SecurityEventConnectionPanel(props: {
+  connection: SecurityEventConnectionResponse | null;
+  issuer: string;
+  loading: boolean;
+  onIssuerChange(value: string): void;
+  onConnect(issuer: string): Promise<void>;
+  onDisconnect(): void;
+  onRefresh(): Promise<void>;
+  onRotate(): Promise<void>;
+  onVerify(): Promise<void>;
+}) {
+  const connection = props.connection?.connection;
+  const prerequisites = props.connection?.prerequisites;
+  const missing = [
+    !prerequisites?.oidcConfigured ? '先完成 OIDC Issuer、Tenant 和 Audience 配置' : '',
+    !prerequisites?.introspectionClientConfigured ? '配置 RFC 7662 机器 Client ID / Secret' : '',
+    !prerequisites?.publicBaseUrlConfigured ? '配置 AI_GATEWAY_PUBLIC_BASE_URL' : '',
+  ].filter(Boolean);
+  return (
+    <section className="fileStoragePanel">
+      <div className="fileStorageSettingsCard">
+        <div>
+          <strong>SSF / CAEP 实时会话撤销</strong>
+          <span>只需连接认证中心。Gateway 后端自动生成并托管 Push Bearer，复用现有 RFC 7662 机器 Client，不需要重启。</span>
+        </div>
+        <Badge variant={connection?.lifecycleStatus === 'enabled' ? 'success' : connection ? 'secondary' : 'outline'}>
+          {securityEventLifecycleLabel(connection?.lifecycleStatus)}
+        </Badge>
+        <Button type="button" variant="outline" size="sm" onClick={() => void props.onRefresh()} disabled={props.loading}>
+          <RefreshCw size={14} />刷新
+        </Button>
+      </div>
+      {!connection && (
+        <Card>
+          <CardContent className="pageStack">
+            <div>
+              <strong>连接认证中心</strong>
+              <p className="mutedText">请先在认证中心 Application 的“安全事件流”中完成“准备 Gateway 接入”。</p>
+            </div>
+            {missing.length > 0 && <div className="formMessage">{missing.join('；')}</div>}
+            <div className="fileStorageMeta">
+              <span>复用机器 Client: {prerequisites?.managementClientId || '未配置'}</span>
+            </div>
+            <Label>
+              SSF Transmitter Issuer
+              <Input value={props.issuer} onChange={(event) => props.onIssuerChange(event.target.value)} placeholder="https://auth.51easyai.com/ssf" />
+              <small>页面只提交公开 Issuer；Endpoint、Scope、Push Bearer 和 Stream 由后端自动处理。</small>
+            </Label>
+            <Button type="button" disabled={props.loading || missing.length > 0 || !props.issuer.trim()} onClick={() => void props.onConnect(props.issuer.trim())}>
+              <Link2 size={15} />连接认证中心
+            </Button>
+          </CardContent>
+        </Card>
+      )}
+      {connection && (
+        <Card>
+          <CardContent className="pageStack">
+            <div className="fileStorageMeta">
+              <span>机器 Client: {connection.managementClientId}</span>
+              <span>Receiver Endpoint: {connection.receiverEndpoint}</span>
+              <span>Issuer: {connection.transmitterIssuer}</span>
+              <span>Audience: {connection.audience ?? '正在获取'}</span>
+              <span>Stream ID: {connection.streamId ?? '正在创建'}</span>
+              <span>健康模式: {securityEventHealthLabel(connection.healthMode)}</span>
+              <span>最近 Verification: {connection.lastVerificationAt ? new Date(connection.lastVerificationAt).toLocaleString() : '尚未成功'}</span>
+              {connection.lastErrorCategory && <span>最近错误: {connection.lastErrorCategory}</span>}
+            </div>
+            <div className="fileStorageToolbar">
+              <Button type="button" variant="outline" size="sm" disabled={props.loading} onClick={() => void props.onVerify()}><RefreshCw size={14} />重新验证</Button>
+              <Button type="button" variant="outline" size="sm" disabled={props.loading || connection.lifecycleStatus === 'rotating'} onClick={() => void props.onRotate()}><RotateCcw size={14} />轮换接收凭据</Button>
+              <Button type="button" variant="destructive" size="sm" disabled={props.loading || connection.lifecycleStatus === 'retiring'} onClick={props.onDisconnect}><Unplug size={14} />断开连接</Button>
+            </div>
+          </CardContent>
+        </Card>
+      )}
+    </section>
+  );
+}
+
+function securityEventLifecycleLabel(status?: string) {
+  return ({ connecting: '连接中', verifying: '验证中', bootstrap: '内省保护期', enabled: '推送健康', degraded: '已降级', rotating: '轮换中', disconnect_pending: '等待断开', retiring: '安全退役中', error: '连接异常' } as Record<string, string>)[status ?? ''] ?? '未连接';
+}
+
+function securityEventHealthLabel(mode: string) {
+  return ({ disabled: '未启用', bootstrap: 'RFC 7662 启动保护', push_healthy: 'Push 健康', introspection_fallback: 'RFC 7662 降级' } as Record<string, string>)[mode] ?? mode;
+}
+
 function defaultClientCustomizationForm(): ClientCustomizationForm {
   return {
     clientEnglishName: 'EasyAI AI Gateway',