fix: 修复 OIDC 用户预配与跨标签页登录态

增加受控 JIT 本地用户投影，并使用 HttpOnly Cookie 在新标签页恢复认证中心登录态。补充错误语义、安全校验、自动化测试与回滚配置。

apps/api/internal/httpapi/access_rule_handlers.go

@@ -38,8 +38,9 @@ func (s *Server) listAccessRules(w http.ResponseWriter, r *http.Request) {
 // @Produce json
 // @Security BearerAuth
 // @Success 200 {object} AccessRuleListResponse
-// @Failure 400 {object} ErrorEnvelope
 // @Failure 401 {object} ErrorEnvelope
+// @Failure 403 {object} ErrorEnvelope
+// @Failure 503 {object} ErrorEnvelope
 // @Failure 500 {object} ErrorEnvelope
 // @Router /api/v1/api-keys/access-rules [get]
 func (s *Server) listAPIKeyAccessRules(w http.ResponseWriter, r *http.Request) {
@@ -47,7 +48,7 @@ func (s *Server) listAPIKeyAccessRules(w http.ResponseWriter, r *http.Request) {
 	items, err := s.store.ListAPIKeyAccessRules(r.Context(), user)
 	if err != nil {
 		if errors.Is(err, store.ErrLocalUserRequired) {
-			writeError(w, http.StatusBadRequest, err.Error())
+			writeLocalUserRequired(w)
 			return
 		}
 		s.logger.Error("list api key access rules failed", "error", err)
@@ -157,7 +158,7 @@ func (s *Server) batchAPIKeyAccessRules(w http.ResponseWriter, r *http.Request)
 	items, err := s.store.BatchAPIKeyAccessRules(r.Context(), input, user)
 	if err != nil {
 		if errors.Is(err, store.ErrLocalUserRequired) {
-			writeError(w, http.StatusBadRequest, err.Error())
+			writeLocalUserRequired(w)
 			return
 		}
 		if store.IsNotFound(err) {