fix(identity): 完善统一认证配对恢复与安全退役

修复 credentials_saved 状态无法恢复、配对与激活并发冲突，以及 SSF 和身份 Secret 生命周期不完整的问题。新增持久化协调器、取消与清理状态机、事务级并发门禁、受控 SSF 凭据交接、禁用后的延迟 Secret 清理，并对生产环境统一认证及 Discovery 端点强制 HTTPS。

验证：go test ./...；go test -race ./internal/auth ./internal/identity ./internal/identityruntime ./internal/securityevents ./internal/httpapi ./internal/store -count=1；go vet ./...；真实 PostgreSQL 并发及清理成功/冲突回滚测试；pnpm openapi。

apps/api/internal/auth/oidc_session_cookie_test.go

@@ -2,10 +2,13 @@ package auth
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"time"
+
+	"github.com/golang-jwt/jwt/v5"
 )
 
 func TestAuthenticateResolvesOpaqueOIDCSessionCookie(t *testing.T) {
@@ -49,6 +52,47 @@ func TestAuthenticateBearerTakesPrecedenceOverOIDCSessionCookie(t *testing.T) {
 	}
 }
 
+func TestAuthenticateRejectsMalformedExplicitCredentialInsteadOfFallingBackToCookie(t *testing.T) {
+	authenticator := New("local-jwt-secret", "", "")
+	var resolved bool
+	authenticator.OIDCSessionResolver = func(context.Context, string) (*User, error) {
+		resolved = true
+		return &User{ID: "cookie-manager", Source: "gateway", Roles: []string{"manager"}}, nil
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/admin/system/identity/disable", nil)
+	request.Header.Set("Authorization", "not-a-bearer-credential")
+	request.AddCookie(&http.Cookie{Name: OIDCSessionCookieName, Value: "valid-cookie-session"})
+
+	if _, err := authenticator.Authenticate(request); !errors.Is(err, ErrUnauthorized) {
+		t.Fatalf("malformed explicit credential error=%v, want unauthorized", err)
+	}
+	if resolved {
+		t.Fatal("malformed Authorization header fell back to the OIDC session cookie")
+	}
+}
+
+func TestAuthenticateRejectsManagerJWTInQueryWithoutCookieFallback(t *testing.T) {
+	authenticator := New("local-jwt-secret", "", "")
+	managerToken, err := authenticator.SignJWT(&User{ID: "manager", Source: "gateway", Roles: []string{"manager"}}, time.Hour)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var resolved bool
+	authenticator.OIDCSessionResolver = func(context.Context, string) (*User, error) {
+		resolved = true
+		return &User{ID: "cookie-manager", Source: "gateway", Roles: []string{"manager"}}, nil
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/admin/system/identity/disable?key="+managerToken, nil)
+	request.AddCookie(&http.Cookie{Name: OIDCSessionCookieName, Value: "valid-cookie-session"})
+
+	if _, err := authenticator.Authenticate(request); !errors.Is(err, ErrUnauthorized) {
+		t.Fatalf("manager query JWT error=%v, want unauthorized", err)
+	}
+	if resolved {
+		t.Fatal("rejected query credential fell back to the OIDC session cookie")
+	}
+}
+
 func TestAuthenticateRejectsInvalidOIDCSessionCookie(t *testing.T) {
 	authenticator := New("local-jwt-secret", "", "")
 	request := httptest.NewRequest(http.MethodGet, "/api/v1/me", nil)
@@ -81,6 +125,46 @@ func TestAuthenticatorReadsOIDCSessionResolverAndLegacyPolicyDynamically(t *test
 	}
 }
 
+func TestAuthenticateKeepsOnlySignedBreakGlassManagerWhenLegacyJWTDisabled(t *testing.T) {
+	authenticator := New("local-jwt-secret", "", "")
+	authenticator.LegacyJWTEnabledProvider = func() bool { return false }
+
+	managerToken, err := authenticator.SignJWT(&User{ID: "manager", Source: "gateway", Roles: []string{"manager"}}, time.Hour)
+	if err != nil {
+		t.Fatal(err)
+	}
+	managerRequest := httptest.NewRequest(http.MethodGet, "/api/admin/system/identity/configuration", nil)
+	managerRequest.Header.Set("Authorization", "Bearer "+managerToken)
+	manager, err := authenticator.Authenticate(managerRequest)
+	if err != nil || manager.ID != "manager" {
+		t.Fatalf("signed break-glass manager was rejected: user=%#v err=%v", manager, err)
+	}
+
+	userToken, err := authenticator.SignJWT(&User{ID: "user", Source: "gateway", Roles: []string{"user"}}, time.Hour)
+	if err != nil {
+		t.Fatal(err)
+	}
+	userRequest := httptest.NewRequest(http.MethodGet, "/api/v1/me", nil)
+	userRequest.Header.Set("Authorization", "Bearer "+userToken)
+	if _, err := authenticator.Authenticate(userRequest); !errors.Is(err, ErrUnauthorized) {
+		t.Fatalf("ordinary local JWT error = %v, want unauthorized", err)
+	}
+
+	legacyManager := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+		"sub": "legacy-manager", "source": "gateway", "role": []string{"manager"},
+		"iat": time.Now().Unix(), "exp": time.Now().Add(time.Hour).Unix(),
+	})
+	legacyManagerToken, err := legacyManager.SignedString([]byte(authenticator.JWTSecret))
+	if err != nil {
+		t.Fatal(err)
+	}
+	legacyRequest := httptest.NewRequest(http.MethodGet, "/api/admin/system/identity/configuration", nil)
+	legacyRequest.Header.Set("Authorization", "Bearer "+legacyManagerToken)
+	if _, err := authenticator.Authenticate(legacyRequest); !errors.Is(err, ErrUnauthorized) {
+		t.Fatalf("legacy manager without token purpose error = %v, want unauthorized", err)
+	}
+}
+
 func TestPublicRouteIgnoresExpiredOptionalOIDCSession(t *testing.T) {
 	authenticator := New("local-jwt-secret", "", "")
 	authenticator.OIDCSessionResolver = func(context.Context, string) (*User, error) {