fix: 修复 OIDC 用户预配与跨标签页登录态

增加受控 JIT 本地用户投影，并使用 HttpOnly Cookie 在新标签页恢复认证中心登录态。补充错误语义、安全校验、自动化测试与回滚配置。

apps/api/internal/auth/oidc.go

@@ -117,6 +117,10 @@ func (v *OIDCVerifier) Verify(ctx context.Context, raw string) (*User, error) {
 	if !ok || stringClaim(claims, "sub") == "" || stringClaim(claims, "tid") != v.config.TenantID {
 		return nil, oidcUnauthorized("stable identity claims are invalid", nil)
 	}
+	expiresAt, ok := numericDateClaim(claims["exp"])
+	if !ok {
+		return nil, oidcUnauthorized("exp is invalid", nil)
+	}
 	if _, ok := numericDateClaim(claims["nbf"]); !ok {
 		return nil, oidcUnauthorized("nbf is missing", nil)
 	}
@@ -143,7 +147,7 @@ func (v *OIDCVerifier) Verify(ctx context.Context, raw string) (*User, error) {
 	}
 	return &User{
 		ID: stringClaim(claims, "sub"), Username: username, Roles: roles,
-		TenantID: v.config.TenantID, Source: "oidc",
+		TenantID: v.config.TenantID, Source: "oidc", TokenExpiresAt: expiresAt,
 	}, nil
 }