feat(identity): 实现统一认证运行时热切换

从 Active Revision 构造并验证 OIDC、BFF Session、Introspection 与 SSF Runtime，在数据库激活成功后原子替换内存引用。请求链路使用不可变快照，失败保留当前运行时，本地管理登录不受影响。\n\n验证：go test ./apps/api/...；go vet ./apps/api/...

apps/api/internal/auth/oidc.go

@@ -112,6 +112,20 @@ func NewOIDCVerifier(config OIDCConfig) (*OIDCVerifier, error) {
 	return &OIDCVerifier{config: config, client: client, keys: map[string]any{}}, nil
 }
 
+// ValidateConfiguration eagerly validates Discovery, JWKS and, when enabled,
+// the RFC 7662 endpoint and machine credential before a runtime is activated.
+func (v *OIDCVerifier) ValidateConfiguration(ctx context.Context) error {
+	if err := v.refresh(ctx, true); err != nil {
+		return err
+	}
+	if v.config.IntrospectionEnabled || v.config.SecurityEventEvaluator != nil {
+		if _, err := v.introspect(ctx, "identity-configuration-probe"); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func (v *OIDCVerifier) Verify(ctx context.Context, raw string) (*User, error) {
 	parser := jwt.NewParser(jwt.WithValidMethods([]string{"RS256", "ES256"}))
 	unverified, _, err := parser.ParseUnverified(raw, jwt.MapClaims{})