fix: 修复 OIDC 用户预配与跨标签页登录态

增加受控 JIT 本地用户投影，并使用 HttpOnly Cookie 在新标签页恢复认证中心登录态。补充错误语义、安全校验、自动化测试与回滚配置。

apps/web/src/lib/oidc.ts

@@ -1,4 +1,5 @@
 const enabled = import.meta.env.VITE_OIDC_ENABLED === 'true';
+const browserSessionEnabled = import.meta.env.VITE_OIDC_BROWSER_SESSION_ENABLED !== 'false';
 const issuer = (import.meta.env.VITE_OIDC_ISSUER ?? '').replace(/\/$/, '');
 const clientId = import.meta.env.VITE_OIDC_CLIENT_ID ?? '';
 const configuredRedirect = import.meta.env.VITE_OIDC_REDIRECT_URI ?? '';
@@ -25,6 +26,10 @@ export function oidcLoginEnabled() {
   return enabled && Boolean(issuer && clientId);
 }
 
+export function oidcBrowserSessionEnabled() {
+  return browserSessionEnabled;
+}
+
 export async function startOIDCLogin() {
   assertConfigured();
   const discovery = await getDiscovery();
@@ -81,7 +86,6 @@ async function completeOIDCLoginOnce(): Promise<{ accessToken: string; returnTo:
   if (!payload.access_token) throw new Error('统一认证未返回 Access Token');
   if (!payload.id_token) throw new Error('统一认证未返回 ID Token');
   validateIDToken(payload.id_token, transaction.nonce);
-  window.sessionStorage.setItem(idTokenKey, payload.id_token);
   window.history.replaceState({}, '', transaction.returnTo || '/');
   return { accessToken: payload.access_token, returnTo: transaction.returnTo || '/' };
 }
@@ -91,10 +95,10 @@ export async function startOIDCLogout() {
   const idToken = window.sessionStorage.getItem(idTokenKey);
   window.sessionStorage.removeItem(idTokenKey);
   window.sessionStorage.removeItem(transactionKey);
-  if (!idToken) return false;
   const discovery = await getDiscovery();
   if (!discovery.end_session_endpoint) return false;
-  const params = new URLSearchParams({ id_token_hint: idToken, post_logout_redirect_uri: window.location.origin + '/' });
+  const params = new URLSearchParams({ client_id: clientId, post_logout_redirect_uri: window.location.origin + '/' });
+  if (idToken) params.set('id_token_hint', idToken);
   window.location.assign(`${discovery.end_session_endpoint}?${params}`);
   return true;
 }