fix: 修复 OIDC 用户预配与跨标签页登录态

增加受控 JIT 本地用户投影，并使用 HttpOnly Cookie 在新标签页恢复认证中心登录态。补充错误语义、安全校验、自动化测试与回滚配置。

.env.example

@@ -35,8 +35,16 @@ OIDC_ACCEPT_LEGACY_HS256=true
 OIDC_INTROSPECTION_ENABLED=false
 OIDC_INTROSPECTION_CLIENT_ID=
 OIDC_INTROSPECTION_CLIENT_SECRET=
+# Controlled JIT is opt-in. When enabled, bind the validated Auth Center tid to
+# one existing active Gateway tenant; tokens never create Gateway tenants.
+OIDC_JIT_PROVISIONING_ENABLED=false
+OIDC_GATEWAY_TENANT_KEY=
+OIDC_BROWSER_SESSION_ENABLED=true
+# Staging/production must use true. Local HTTP development may use false.
+OIDC_SESSION_COOKIE_SECURE=false
 OIDC_CLIENT_ID=
 OIDC_REDIRECT_URI=http://localhost:5178/auth/callback
+VITE_OIDC_BROWSER_SESSION_ENABLED=true
 AI_GATEWAY_WEB_BASE_PATH=/
 AI_GATEWAY_GO_BUILD_IMAGE=golang:1.26.3-alpine
 AI_GATEWAY_API_RUNTIME_IMAGE=alpine:3.22