fix(identity): 完善统一认证配对恢复与安全退役

修复 credentials_saved 状态无法恢复、配对与激活并发冲突，以及 SSF 和身份 Secret 生命周期不完整的问题。新增持久化协调器、取消与清理状态机、事务级并发门禁、受控 SSF 凭据交接、禁用后的延迟 Secret 清理，并对生产环境统一认证及 Discovery 端点强制 HTTPS。

验证：go test ./...；go test -race ./internal/auth ./internal/identity ./internal/identityruntime ./internal/securityevents ./internal/httpapi ./internal/store -count=1；go vet ./...；真实 PostgreSQL 并发及清理成功/冲突回滚测试；pnpm openapi。

apps/api/migrations/0070_identity_secret_cleanup_queue.sql

@@ -0,0 +1,19 @@
+CREATE TABLE IF NOT EXISTS gateway_identity_secret_cleanup_queue (
+  secret_ref text PRIMARY KEY CHECK (secret_ref ~ '^[a-z0-9][a-z0-9-]{0,127}$'),
+  not_before timestamptz NOT NULL,
+  status text NOT NULL DEFAULT 'pending',
+  claim_token uuid,
+  lease_expires_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT gateway_identity_secret_cleanup_status_check
+    CHECK (status IN ('pending','claimed')),
+  CONSTRAINT gateway_identity_secret_cleanup_claim_check
+    CHECK (
+      (status = 'pending' AND claim_token IS NULL AND lease_expires_at IS NULL) OR
+      (status = 'claimed' AND claim_token IS NOT NULL AND lease_expires_at IS NOT NULL)
+    )
+);
+
+CREATE INDEX IF NOT EXISTS idx_gateway_identity_secret_cleanup_due
+  ON gateway_identity_secret_cleanup_queue(status, not_before, lease_expires_at, updated_at);