fix(identity): 完善统一认证配对恢复与安全退役

修复 credentials_saved 状态无法恢复、配对与激活并发冲突，以及 SSF 和身份 Secret 生命周期不完整的问题。新增持久化协调器、取消与清理状态机、事务级并发门禁、受控 SSF 凭据交接、禁用后的延迟 Secret 清理，并对生产环境统一认证及 Discovery 端点强制 HTTPS。

验证：go test ./...；go test -race ./internal/auth ./internal/identity ./internal/identityruntime ./internal/securityevents ./internal/httpapi ./internal/store -count=1；go vet ./...；真实 PostgreSQL 并发及清理成功/冲突回滚测试；pnpm openapi。

packages/contracts/src/index.ts

@@ -1035,19 +1035,25 @@ export type IdentityPairingStatus =
   | 'credentials_saved'
   | 'completed'
   | 'failed'
-  | 'expired';
+  | 'expired'
+  | 'cancelled';
+
+export type IdentityPairingCleanupStatus = 'none' | 'pending' | 'completed';
 
 export interface IdentityPairingExchange {
   id: string;
   revisionId: string;
   remoteExchangeId: string;
   status: IdentityPairingStatus;
+  cleanupStatus: IdentityPairingCleanupStatus;
   remoteVersion: number;
   expiresAt: string;
   version: number;
   lastErrorCategory?: string;
   authCenterAuditId?: string;
   lastTraceId?: string;
+  cancelledAt?: string;
+  cleanupCompletedAt?: string;
   createdAt: string;
   updatedAt: string;
 }