fix(identity): 支持平台用户显式登录 AI Gateway

修复多租户身份配置将所有人类登录都强制解释为租户上下文的问题。Web 现在提供平台与租户两个受控入口，API 严格绑定 context_type、tid、issuer、application 和 subject，并为平台用户建立独立本地投影与可刷新会话。\n\n风险：新增会话身份列保持旧会话可读，新会话一律使用严格约束；未改变租户数据隔离和 API Key 行为。\n\n验证：Go 全量测试与 go vet 通过；PostgreSQL 平台投影、会话和安全事件集成测试通过；前端 lint、141 项测试与生产 build 通过；OpenAPI 生成和迁移安全测试通过。

apps/api/internal/oidcsession/service_test.go

@@ -292,6 +292,53 @@ func TestServiceBindsMultiTenantSessionToIssuerApplicationTenantAndClient(t *tes
 	}
 }
 
+func TestServiceBindsPlatformSessionToExplicitContextWithoutTenant(t *testing.T) {
+	now := time.Date(2026, 7, 31, 12, 0, 0, 0, time.UTC)
+	applicationID := "cccccccc-cccc-4ccc-8ccc-cccccccccccc"
+	verified := &auth.User{
+		ID: "platform-subject", Source: "oidc",
+		Issuer:        "https://auth.example.test",
+		ApplicationID: applicationID, ContextType: "platform",
+		OIDCClientID:   "gateway-browser",
+		TokenExpiresAt: now.Add(5 * time.Minute),
+	}
+	repository := newFakeRepository("platform-subject")
+	service := newTestService(
+		t,
+		repository,
+		fakeVerifier{users: map[string]*auth.User{"access": verified}},
+		&fakePublicClient{},
+	)
+	service.now = func() time.Time { return now }
+	raw, err := service.Create(
+		context.Background(),
+		TokenBundle{AccessToken: "access", RefreshToken: "refresh"},
+		&auth.User{
+			ID:              "platform-subject",
+			GatewayUserID:   "11111111-1111-4111-8111-111111111111",
+			GatewayTenantID: "22222222-2222-4222-8222-222222222222",
+			ContextType:     "platform",
+		},
+	)
+	if err != nil {
+		t.Fatalf("Create() error = %v", err)
+	}
+	record := repository.snapshot()
+	if record.ContextType != "platform" || record.TenantID != "" ||
+		record.Issuer != verified.Issuer ||
+		record.ApplicationID != applicationID {
+		t.Fatalf("platform session record=%#v", record)
+	}
+	verified.ContextType = "tenant"
+	verified.TenantID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
+	if _, err := service.Resolve(
+		context.Background(),
+		raw,
+	); !errors.Is(err, ErrSessionInvalid) {
+		t.Fatalf("Resolve() error = %v, want ErrSessionInvalid", err)
+	}
+}
+
 func TestServiceCreateReportsSafeFailureCategory(t *testing.T) {
 	now := time.Date(2026, 7, 29, 9, 0, 0, 0, time.UTC)
 	validVerified := &auth.User{
@@ -445,11 +492,16 @@ func (f *fakeRepository) CreateOIDCSession(_ context.Context, input store.Create
 	if f.createError != nil {
 		return store.OIDCSession{}, f.createError
 	}
+	external := input.Subject
+	if external == "" {
+		external = f.external
+	}
 	f.record = store.OIDCSession{
 		ID: "33333333-3333-4333-8333-333333333333", SessionTokenHash: append([]byte(nil), input.SessionTokenHash...),
-		GatewayUserID: input.GatewayUserID, GatewayTenantID: input.GatewayTenantID, ExternalUserID: f.external,
+		GatewayUserID: input.GatewayUserID, GatewayTenantID: input.GatewayTenantID, ExternalUserID: external,
 		OIDCUserBindingID: input.OIDCUserBindingID, OIDCClientID: input.OIDCClientID,
-		Issuer: input.Issuer, ApplicationID: input.ApplicationID, TenantID: input.TenantID,
+		Issuer: input.Issuer, ApplicationID: input.ApplicationID,
+		ContextType: input.ContextType, TenantID: input.TenantID,
 		UserStatus: "active", TokenCiphertext: append([]byte(nil), input.TokenCiphertext...), AccessTokenExpiresAt: input.AccessTokenExpiresAt,
 		LastSeenAt: input.LastSeenAt, IdleExpiresAt: input.IdleExpiresAt, AbsoluteExpiresAt: input.AbsoluteExpiresAt, RefreshVersion: 1,
 	}