feat: 接入 OIDC 公共客户端登录链路

由 Gateway 服务端完成 PKCE 换码、ID Token 校验、JIT 用户解析和 Session 建立。新增登录、回调、退出与本地会话删除接口，并移除旧的 Access Token Cookie 桥接接口。

apps/api/docs/swagger.json

@@ -4279,16 +4279,16 @@
                 }
             }
         },
-        "/api/v1/auth/oidc/session": {
-            "post": {
-                "description": "验证 Auth Center Access Token 后写入 HttpOnly 会话 Cookie；不会签发 Gateway JWT。",
+        "/api/v1/auth/oidc/callback": {
+            "get": {
+                "description": "Gateway 使用 client_id、授权码和 PKCE verifier 换取 Token，不发送 Client Secret；Token 加密存入服务端 Session。",
                 "tags": [
                     "auth"
                 ],
-                "summary": "建立 OIDC 浏览器会话",
+                "summary": "完成 OIDC 公共客户端登录",
                 "responses": {
-                    "204": {
-                        "description": "No Content"
+                    "303": {
+                        "description": "See Other"
                     },
                     "400": {
                         "description": "Bad Request",
@@ -4302,6 +4302,40 @@
                             "$ref": "#/definitions/httpapi.ErrorEnvelope"
                         }
                     },
+                    "503": {
+                        "description": "Service Unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    }
+                }
+            }
+        },
+        "/api/v1/auth/oidc/login": {
+            "get": {
+                "description": "Gateway 生成 state、nonce 和 PKCE S256 参数，并跳转认证中心；浏览器不接触 Token。",
+                "tags": [
+                    "auth"
+                ],
+                "summary": "开始 OIDC 公共客户端登录",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "登录后返回的站内相对路径",
+                        "name": "returnTo",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "303": {
+                        "description": "See Other"
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    },
                     "404": {
                         "description": "Not Found",
                         "schema": {
@@ -4309,15 +4343,49 @@
                         }
                     }
                 }
-            },
+            }
+        },
+        "/api/v1/auth/oidc/logout": {
+            "post": {
+                "description": "删除 Gateway Session、撤销公共 Client Refresh Token，并跳转认证中心退出地址。",
+                "tags": [
+                    "auth"
+                ],
+                "summary": "注销 OIDC 登录会话",
+                "responses": {
+                    "303": {
+                        "description": "See Other"
+                    },
+                    "403": {
+                        "description": "Forbidden",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    },
+                    "503": {
+                        "description": "Service Unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    }
+                }
+            }
+        },
+        "/api/v1/auth/oidc/session": {
             "delete": {
                 "tags": [
                     "auth"
                 ],
-                "summary": "注销 OIDC 浏览器会话",
+                "summary": "删除本地 OIDC 浏览器会话",
                 "responses": {
                     "204": {
                         "description": "No Content"
+                    },
+                    "503": {
+                        "description": "Service Unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
                     }
                 }
             }