fix(identity): 支持平台用户显式登录 AI Gateway

修复多租户身份配置将所有人类登录都强制解释为租户上下文的问题。Web 现在提供平台与租户两个受控入口，API 严格绑定 context_type、tid、issuer、application 和 subject，并为平台用户建立独立本地投影与可刷新会话。\n\n风险：新增会话身份列保持旧会话可读，新会话一律使用严格约束；未改变租户数据隔离和 API Key 行为。\n\n验证：Go 全量测试与 go vet 通过；PostgreSQL 平台投影、会话和安全事件集成测试通过；前端 lint、141 项测试与生产 build 通过；OpenAPI 生成和迁移安全测试通过。

apps/api/docs/swagger.json

@@ -5906,6 +5906,19 @@
                         "description": "登录后返回的站内相对路径",
                         "name": "returnTo",
                         "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "显式登录上下文：platform 或 tenant",
+                        "name": "contextType",
+                        "in": "query",
+                        "required": true
+                    },
+                    {
+                        "type": "string",
+                        "description": "Tenant 上下文可选的稳定 Tenant UUID",
+                        "name": "tenantHint",
+                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -10064,6 +10077,9 @@
                 "apiKeySecret": {
                     "type": "string"
                 },
+                "contextType": {
+                    "type": "string"
+                },
                 "gatewayTenantId": {
                     "type": "string"
                 },
@@ -12432,6 +12448,12 @@
         "httpapi.publicIdentityConfiguration": {
             "type": "object",
             "properties": {
+                "contextTypes": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
                 "enabled": {
                     "type": "boolean"
                 },

apps/api/docs/swagger.yaml

@@ -14,6 +14,8 @@ definitions:
         type: array
       apiKeySecret:
         type: string
+      contextType:
+        type: string
       gatewayTenantId:
         type: string
       gatewayUserId:
@@ -1662,6 +1664,10 @@ definitions:
     type: object
   httpapi.publicIdentityConfiguration:
     properties:
+      contextTypes:
+        items:
+          type: string
+        type: array
       enabled:
         type: boolean
       loginUrl:
@@ -7889,6 +7895,15 @@ paths:
         in: query
         name: returnTo
         type: string
+      - description: 显式登录上下文：platform 或 tenant
+        in: query
+        name: contextType
+        required: true
+        type: string
+      - description: Tenant 上下文可选的稳定 Tenant UUID
+        in: query
+        name: tenantHint
+        type: string
       responses:
         "303":
           description: See Other