fix(oidc): 同步认证中心用户资料到本地用户

从已验证的 OIDC Claim 提取用户名、显示名称、邮箱、手机号和头像，并覆盖单租户、多租户及平台用户的 JIT 创建与重复登录同步。\n\n保留 metadata.manualProfile 标记下的人工资料，限制字段长度且仅接收已验证联系方式与 HTTPS 头像。已通过 auth、httpapi、store 测试及临时 PostgreSQL 集成验证。

apps/api/internal/auth/oidc_test.go

@@ -66,11 +66,27 @@ func TestOIDCVerifierAcceptsRS256AndES256StableClaims(t *testing.T) {
 				t.Fatal(err)
 			}
 			if user.ID != "platform-subject" || user.TenantID != "tenant-1" || user.Source != "oidc" ||
+				user.Username != "acceptance" || user.DisplayName != "王小明" ||
+				user.Email != "real.user@example.test" || user.Phone != "+8613800000000" ||
+				user.AvatarURL != "https://static.example.test/avatar.png" ||
 				len(user.Roles) != 1 || user.Roles[0] != "admin" {
 				t.Fatalf("unexpected OIDC user: %#v", user)
 			}
 		})
 	}
+
+	unverified := signedOIDCToken(t, issuer, "rsa-key", jwt.SigningMethodRS256, rsaKey, func(claims jwt.MapClaims) {
+		claims["email_verified"] = false
+		claims["phone_number_verified"] = false
+		claims["picture"] = "javascript:alert(1)"
+	})
+	user, err := verifier.Verify(context.Background(), unverified)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if user.Email != "" || user.Phone != "" || user.AvatarURL != "" {
+		t.Fatalf("untrusted profile claims were accepted: %#v", user)
+	}
 }
 
 func TestOIDCVerifierRejectsMissingOrMismatchedSecurityClaims(t *testing.T) {
@@ -400,7 +416,10 @@ func signedOIDCToken(t *testing.T, issuer, kid string, method jwt.SigningMethod,
 		"iss": issuer, "aud": "gateway-api", "sub": "platform-subject", "tid": "tenant-1",
 		"context_type":       "tenant",
 		"preferred_username": "acceptance", "roles": []string{"gateway.admin"},
-		"scope": "openid gateway.access", "iat": now.Unix(), "nbf": now.Add(-time.Second).Unix(),
+		"name": "王小明", "email": "real.user@example.test", "email_verified": true,
+		"phone_number": "+8613800000000", "phone_number_verified": true,
+		"picture": "https://static.example.test/avatar.png",
+		"scope":   "openid gateway.access", "iat": now.Unix(), "nbf": now.Add(-time.Second).Unix(),
 		"exp": now.Add(time.Hour).Unix(),
 	}
 	if mutate != nil {