fix(identity): 支持平台用户显式登录 AI Gateway

修复多租户身份配置将所有人类登录都强制解释为租户上下文的问题。Web 现在提供平台与租户两个受控入口，API 严格绑定 context_type、tid、issuer、application 和 subject，并为平台用户建立独立本地投影与可刷新会话。\n\n风险：新增会话身份列保持旧会话可读，新会话一律使用严格约束；未改变租户数据隔离和 API Key 行为。\n\n验证：Go 全量测试与 go vet 通过；PostgreSQL 平台投影、会话和安全事件集成测试通过；前端 lint、141 项测试与生产 build 通过；OpenAPI 生成和迁移安全测试通过。

apps/api/internal/oidcsession/login_transaction.go

@@ -20,18 +20,37 @@ type LoginTransaction struct {
 	Nonce        string    `json:"nonce"`
 	PKCEVerifier string    `json:"pkceVerifier"`
 	ReturnTo     string    `json:"returnTo"`
+	ContextType  string    `json:"contextType"`
 	TenantHint   string    `json:"tenantHint,omitempty"`
 	CreatedAt    time.Time `json:"createdAt"`
 }
 
 func NewLoginTransaction(returnTo string, now time.Time) (LoginTransaction, error) {
-	return NewLoginTransactionWithTenantHint(returnTo, "", now)
+	return NewLoginTransactionWithContext(returnTo, "tenant", "", now)
 }
 
 func NewLoginTransactionWithTenantHint(returnTo, tenantHint string, now time.Time) (LoginTransaction, error) {
+	return NewLoginTransactionWithContext(returnTo, "tenant", tenantHint, now)
+}
+
+func NewLoginTransactionWithContext(
+	returnTo, contextType, tenantHint string,
+	now time.Time,
+) (LoginTransaction, error) {
 	if !ValidReturnTo(returnTo) {
 		return LoginTransaction{}, errors.New("returnTo must be a same-origin relative path")
 	}
+	contextType = strings.TrimSpace(contextType)
+	tenantHint = strings.TrimSpace(tenantHint)
+	if contextType != "platform" && contextType != "tenant" {
+		return LoginTransaction{}, errors.New("contextType must be platform or tenant")
+	}
+	if contextType == "platform" && tenantHint != "" {
+		return LoginTransaction{}, errors.New("platform context cannot bind a tenant hint")
+	}
+	if tenantHint != "" && uuid.Validate(tenantHint) != nil {
+		return LoginTransaction{}, errors.New("tenantHint must be a UUID")
+	}
 	state, err := randomBase64URL(32)
 	if err != nil {
 		return LoginTransaction{}, err
@@ -46,7 +65,8 @@ func NewLoginTransactionWithTenantHint(returnTo, tenantHint string, now time.Tim
 	}
 	return LoginTransaction{
 		State: state, Nonce: nonce, PKCEVerifier: verifier,
-		ReturnTo: returnTo, TenantHint: strings.TrimSpace(tenantHint), CreatedAt: now.UTC(),
+		ReturnTo: returnTo, ContextType: contextType,
+		TenantHint: tenantHint, CreatedAt: now.UTC(),
 	}, nil
 }
 
@@ -68,6 +88,8 @@ func (c *Cipher) DecodeLoginTransaction(encoded string, now time.Time) (LoginTra
 		return LoginTransaction{}, err
 	}
 	if transaction.State == "" || transaction.Nonce == "" || transaction.PKCEVerifier == "" || !ValidReturnTo(transaction.ReturnTo) ||
+		transaction.ContextType != "platform" && transaction.ContextType != "tenant" ||
+		transaction.ContextType == "platform" && transaction.TenantHint != "" ||
 		transaction.TenantHint != "" && uuid.Validate(transaction.TenantHint) != nil ||
 		transaction.CreatedAt.IsZero() || now.Before(transaction.CreatedAt.Add(-time.Minute)) || !now.Before(transaction.CreatedAt.Add(10*time.Minute)) {
 		return LoginTransaction{}, errors.New("OIDC login transaction has expired or is invalid")