refactor(identity): 统一网页认证配置来源

移除旧 OIDC_* 与 VITE_OIDC_* 业务配置读取，统一使用数据库 Revision 和 SecretStore 引用构建运行时。同步更新 Compose、示例配置、接入文档及集成测试，并保留数据库、SecretStore 和安全事件健康窗口等部署级参数。\n\n验证：go test ./...；go test -race ./...；go vet ./...；pnpm test；pnpm lint；pnpm build；docker compose config -q

.env.example

@@ -23,52 +23,19 @@ CONFIG_JWT_SECRET=this is a very secret secret
 # - hybrid: both sources are accepted and separated by gateway_users.source.
 IDENTITY_MODE=hybrid
 
-# Auth Center stable OIDC verification. Keep legacy HS256 during the staged rollout.
-OIDC_ENABLED=false
-OIDC_ISSUER=https://auth.51easyai.com/issuer/shared
-OIDC_AUDIENCE=https://api.51easyai.com/gateway
-OIDC_TENANT_ID=
-OIDC_ROLE_PREFIX=gateway.
-OIDC_REQUIRED_SCOPES=gateway.access
-OIDC_JWKS_CACHE_TTL_SECONDS=300
-OIDC_ACCEPT_LEGACY_HS256=true
-OIDC_INTROSPECTION_ENABLED=false
-# Legacy/static fallback only. New SSF connections receive the machine
-# credential once in the web flow and persist it in the configured SecretStore.
-OIDC_INTROSPECTION_CLIENT_ID=
-OIDC_INTROSPECTION_CLIENT_SECRET=
-# SSF/CAEP is activated by the durable connection created in System Settings;
-# there is no enable flag and no Push Bearer in environment variables.
+# Unified identity business settings are managed in System Settings > Unified
+# Identity. Deployment only supplies the SecretStore and infrastructure timing.
 AI_GATEWAY_PUBLIC_BASE_URL=http://localhost:8088
-OIDC_SECURITY_EVENTS_SECRET_STORE=file
-OIDC_SECURITY_EVENTS_SECRET_DIR=.local-secrets/ssf
+IDENTITY_SECRET_STORE=file
+IDENTITY_SECRET_DIR=.local-secrets/identity
 # Kubernetes uses one pre-provisioned empty Secret and narrowly scoped RBAC.
-# OIDC_SECURITY_EVENTS_SECRET_STORE=kubernetes
-# OIDC_SECURITY_EVENTS_KUBERNETES_NAMESPACE=easyai
-# OIDC_SECURITY_EVENTS_KUBERNETES_SECRET_NAME=easyai-gateway-security-events
-# OIDC_SECURITY_EVENTS_KUBERNETES_API_SERVER=https://kubernetes.default.svc
-OIDC_SECURITY_EVENTS_HEARTBEAT_INTERVAL_SECONDS=60
-OIDC_SECURITY_EVENTS_STALE_AFTER_SECONDS=180
-OIDC_SECURITY_EVENTS_CLOCK_SKEW_SECONDS=60
-# Controlled JIT is opt-in. When enabled, bind the validated Auth Center tid to
-# one existing active Gateway tenant; tokens never create Gateway tenants.
-OIDC_JIT_PROVISIONING_ENABLED=false
-OIDC_GATEWAY_TENANT_KEY=
-OIDC_BROWSER_SESSION_ENABLED=true
-# Staging/production must use true. Local HTTP development may use false.
-OIDC_SESSION_COOKIE_SECURE=false
-# Public Client ID generated by Auth Center Control Plane. No Client Secret is used.
-OIDC_CLIENT_ID=
-OIDC_REDIRECT_URI=http://localhost:8088/api/v1/auth/oidc/callback
-OIDC_POST_LOGOUT_REDIRECT_URI=http://localhost:5178/
-# Generate a dedicated value with: openssl rand -base64 32
-# Keep the real value only in a Git-ignored local file or Secret Manager.
-OIDC_SESSION_ENCRYPTION_KEY=
-OIDC_SESSION_IDLE_TTL_SECONDS=1800
-OIDC_SESSION_ABSOLUTE_TTL_SECONDS=28800
-OIDC_SESSION_REFRESH_BEFORE_SECONDS=60
-VITE_OIDC_BROWSER_SESSION_ENABLED=true
-VITE_OIDC_ENABLED=false
+# IDENTITY_SECRET_STORE=kubernetes
+# IDENTITY_KUBERNETES_NAMESPACE=easyai
+# IDENTITY_KUBERNETES_SECRET_NAME=easyai-gateway-identity
+# IDENTITY_KUBERNETES_API_SERVER=https://kubernetes.default.svc
+IDENTITY_SECURITY_EVENTS_HEARTBEAT_INTERVAL_SECONDS=60
+IDENTITY_SECURITY_EVENTS_STALE_AFTER_SECONDS=180
+IDENTITY_SECURITY_EVENTS_CLOCK_SKEW_SECONDS=60
 AI_GATEWAY_WEB_BASE_URL=http://localhost:5178
 AI_GATEWAY_WEB_BASE_PATH=/
 AI_GATEWAY_GO_BUILD_IMAGE=golang:1.26.3-alpine