feat: 实现 OIDC 服务端会话与请求刷新

使用 AES-256-GCM 保存认证中心令牌，并以随机 Cookie 哈希关联 PostgreSQL 会话。加入闲置与绝对期限、Refresh Token 轮换以及多实例刷新锁。

apps/api/migrations/0061_oidc_server_sessions.sql

@@ -0,0 +1,24 @@
+CREATE TABLE IF NOT EXISTS gateway_oidc_sessions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  session_token_hash bytea NOT NULL UNIQUE,
+  gateway_user_id uuid NOT NULL REFERENCES gateway_users(id) ON DELETE CASCADE,
+  gateway_tenant_id uuid NOT NULL REFERENCES gateway_tenants(id) ON DELETE CASCADE,
+  token_ciphertext bytea NOT NULL,
+  access_token_expires_at timestamptz NOT NULL,
+  last_seen_at timestamptz NOT NULL,
+  idle_expires_at timestamptz NOT NULL,
+  absolute_expires_at timestamptz NOT NULL,
+  refresh_version bigint NOT NULL DEFAULT 1,
+  refresh_lock_id uuid,
+  refresh_lock_until timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT gateway_oidc_sessions_hash_length CHECK (octet_length(session_token_hash) = 32),
+  CONSTRAINT gateway_oidc_sessions_expiry_order CHECK (idle_expires_at <= absolute_expires_at)
+);
+
+CREATE INDEX IF NOT EXISTS idx_gateway_oidc_sessions_expiry
+  ON gateway_oidc_sessions(absolute_expires_at, idle_expires_at);
+
+CREATE INDEX IF NOT EXISTS idx_gateway_oidc_sessions_user
+  ON gateway_oidc_sessions(gateway_user_id, created_at DESC);