fix: 修复 OIDC 用户预配与跨标签页登录态

增加受控 JIT 本地用户投影，并使用 HttpOnly Cookie 在新标签页恢复认证中心登录态。补充错误语义、安全校验、自动化测试与回滚配置。

Dockerfile

@@ -75,12 +75,14 @@ ARG VITE_OIDC_ENABLED=false
 ARG VITE_OIDC_ISSUER=
 ARG VITE_OIDC_CLIENT_ID=
 ARG VITE_OIDC_REDIRECT_URI=
+ARG VITE_OIDC_BROWSER_SESSION_ENABLED=true
 ARG VITE_BASE_PATH=/
 ENV VITE_GATEWAY_API_BASE_URL=$VITE_GATEWAY_API_BASE_URL
 ENV VITE_OIDC_ENABLED=$VITE_OIDC_ENABLED \
     VITE_OIDC_ISSUER=$VITE_OIDC_ISSUER \
     VITE_OIDC_CLIENT_ID=$VITE_OIDC_CLIENT_ID \
     VITE_OIDC_REDIRECT_URI=$VITE_OIDC_REDIRECT_URI \
+    VITE_OIDC_BROWSER_SESSION_ENABLED=$VITE_OIDC_BROWSER_SESSION_ENABLED \
     VITE_BASE_PATH=$VITE_BASE_PATH
 RUN pnpm --filter @easyai-ai-gateway/web build