feat: 接入 OIDC 公共客户端登录链路

由 Gateway 服务端完成 PKCE 换码、ID Token 校验、JIT 用户解析和 Session 建立。新增登录、回调、退出与本地会话删除接口，并移除旧的 Access Token Cookie 桥接接口。

apps/api/docs/swagger.json

@@ -4279,16 +4279,16 @@
                 }
             }
         },
-        "/api/v1/auth/oidc/session": {
-            "post": {
-                "description": "验证 Auth Center Access Token 后写入 HttpOnly 会话 Cookie；不会签发 Gateway JWT。",
+        "/api/v1/auth/oidc/callback": {
+            "get": {
+                "description": "Gateway 使用 client_id、授权码和 PKCE verifier 换取 Token，不发送 Client Secret；Token 加密存入服务端 Session。",
                 "tags": [
                     "auth"
                 ],
-                "summary": "建立 OIDC 浏览器会话",
+                "summary": "完成 OIDC 公共客户端登录",
                 "responses": {
-                    "204": {
-                        "description": "No Content"
+                    "303": {
+                        "description": "See Other"
                     },
                     "400": {
                         "description": "Bad Request",
@@ -4302,6 +4302,40 @@
                             "$ref": "#/definitions/httpapi.ErrorEnvelope"
                         }
                     },
+                    "503": {
+                        "description": "Service Unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    }
+                }
+            }
+        },
+        "/api/v1/auth/oidc/login": {
+            "get": {
+                "description": "Gateway 生成 state、nonce 和 PKCE S256 参数，并跳转认证中心；浏览器不接触 Token。",
+                "tags": [
+                    "auth"
+                ],
+                "summary": "开始 OIDC 公共客户端登录",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "登录后返回的站内相对路径",
+                        "name": "returnTo",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "303": {
+                        "description": "See Other"
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    },
                     "404": {
                         "description": "Not Found",
                         "schema": {
@@ -4309,15 +4343,49 @@
                         }
                     }
                 }
-            },
+            }
+        },
+        "/api/v1/auth/oidc/logout": {
+            "post": {
+                "description": "删除 Gateway Session、撤销公共 Client Refresh Token，并跳转认证中心退出地址。",
+                "tags": [
+                    "auth"
+                ],
+                "summary": "注销 OIDC 登录会话",
+                "responses": {
+                    "303": {
+                        "description": "See Other"
+                    },
+                    "403": {
+                        "description": "Forbidden",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    },
+                    "503": {
+                        "description": "Service Unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    }
+                }
+            }
+        },
+        "/api/v1/auth/oidc/session": {
             "delete": {
                 "tags": [
                     "auth"
                 ],
-                "summary": "注销 OIDC 浏览器会话",
+                "summary": "删除本地 OIDC 浏览器会话",
                 "responses": {
                     "204": {
                         "description": "No Content"
+                    },
+                    "503": {
+                        "description": "Service Unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
                     }
                 }
             }

apps/api/docs/swagger.yaml

@@ -5276,20 +5276,13 @@ paths:
       summary: 本地登录
       tags:
       - auth
-  /api/v1/auth/oidc/session:
-    delete:
+  /api/v1/auth/oidc/callback:
+    get:
+      description: Gateway 使用 client_id、授权码和 PKCE verifier 换取 Token，不发送 Client Secret；Token
+        加密存入服务端 Session。
       responses:
-        "204":
-          description: No Content
-      summary: 注销 OIDC 浏览器会话
-      tags:
-      - auth
-    post:
-      description: 验证 Auth Center Access Token 后写入 HttpOnly 会话 Cookie；不会签发 Gateway
-        JWT。
-      responses:
-        "204":
-          description: No Content
+        "303":
+          description: See Other
         "400":
           description: Bad Request
           schema:
@@ -5298,11 +5291,62 @@ paths:
           description: Unauthorized
           schema:
             $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+      summary: 完成 OIDC 公共客户端登录
+      tags:
+      - auth
+  /api/v1/auth/oidc/login:
+    get:
+      description: Gateway 生成 state、nonce 和 PKCE S256 参数，并跳转认证中心；浏览器不接触 Token。
+      parameters:
+      - description: 登录后返回的站内相对路径
+        in: query
+        name: returnTo
+        type: string
+      responses:
+        "303":
+          description: See Other
+        "400":
+          description: Bad Request
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
         "404":
           description: Not Found
           schema:
             $ref: '#/definitions/httpapi.ErrorEnvelope'
-      summary: 建立 OIDC 浏览器会话
+      summary: 开始 OIDC 公共客户端登录
+      tags:
+      - auth
+  /api/v1/auth/oidc/logout:
+    post:
+      description: 删除 Gateway Session、撤销公共 Client Refresh Token，并跳转认证中心退出地址。
+      responses:
+        "303":
+          description: See Other
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+      summary: 注销 OIDC 登录会话
+      tags:
+      - auth
+  /api/v1/auth/oidc/session:
+    delete:
+      responses:
+        "204":
+          description: No Content
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+      summary: 删除本地 OIDC 浏览器会话
       tags:
       - auth
   /api/v1/auth/register: