fix(web): 完善统一认证恢复与重配交互

为处理中、失败和清理中的配对展示明确状态与恢复动作，支持放弃并清理、作用域内退役冲突连接，并在 Active 状态引导管理员先安全禁用再使用新接入码。同步修复运行时切换后的浏览器会话残留与确认弹窗焦点约束。

验证：pnpm test；pnpm lint；pnpm build。

apps/web/src/lib/oidc-browser-session.ts

@@ -11,6 +11,13 @@ export interface RestoredOIDCBrowserSession {
   user: CurrentUser;
 }
 
+export interface ReconcileOIDCBrowserSessionOptions {
+  credential: string;
+  oidcEnabled: boolean;
+  onReset: () => void;
+  onRestored: (session: RestoredOIDCBrowserSession) => void;
+}
+
 export async function restoreOIDCBrowserSession(): Promise<RestoredOIDCBrowserSession | null> {
   try {
     const user = await getCurrentUser(OIDC_BROWSER_SESSION_CREDENTIAL);
@@ -20,3 +27,20 @@ export async function restoreOIDCBrowserSession(): Promise<RestoredOIDCBrowserSe
     throw error;
   }
 }
+
+export async function reconcileOIDCBrowserSessionAfterRuntimeChange(
+  options: ReconcileOIDCBrowserSessionOptions,
+): Promise<'ignored' | 'reset' | 'restored'> {
+  if (options.credential !== OIDC_BROWSER_SESSION_CREDENTIAL) return 'ignored';
+  if (!options.oidcEnabled) {
+    options.onReset();
+    return 'reset';
+  }
+  const restored = await restoreOIDCBrowserSession();
+  if (!restored) {
+    options.onReset();
+    return 'reset';
+  }
+  options.onRestored(restored);
+  return 'restored';
+}