feat(acceptance): 建立同构验收与弹性容量体系

实现本地三节点 K3s 同构环境、脱敏生产快照、Gemini 图片和多参考图视频协议模拟、统一验收报告及故障注入。\n\n新增 Worker 容量控制器、资源与连接预算、任务恢复保护，并将生产验收拆分为 validation 执行和人工 CAS 放量。\n\n验证包括 Go 全量测试、PostgreSQL HTTP 集成测试、go vet、OpenAPI、ShellCheck、前端检查、迁移及发布脚本测试。

apps/api/internal/httpapi/oidc_jit_integration_test.go

@@ -44,6 +44,25 @@ func TestOIDCJITFullGatewayUserFlowAndSecurityBoundary(t *testing.T) {
 		t.Fatalf("connect store: %v", err)
 	}
 	t.Cleanup(db.Close)
+	hasBreakGlass, err := db.HasBreakGlassManager(ctx)
+	if err != nil {
+		t.Fatalf("check OIDC JIT break-glass manager: %v", err)
+	}
+	if !hasBreakGlass {
+		manager, registerErr := db.RegisterLocalUser(ctx, store.LocalRegisterInput{
+			Username: "oidc-jit-manager-" + uuid.NewString(),
+			Password: uuid.NewString() + "-local-only",
+		})
+		if registerErr != nil {
+			t.Fatalf("create OIDC JIT break-glass manager: %v", registerErr)
+		}
+		if _, updateErr := db.Pool().Exec(ctx, `UPDATE gateway_users SET roles='["manager"]'::jsonb WHERE id=$1::uuid`, manager.ID); updateErr != nil {
+			t.Fatalf("grant OIDC JIT break-glass manager role: %v", updateErr)
+		}
+		t.Cleanup(func() {
+			_, _ = db.Pool().Exec(context.Background(), `DELETE FROM gateway_users WHERE id=$1::uuid`, manager.ID)
+		})
+	}
 
 	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
@@ -388,7 +407,7 @@ func createOIDCBFFSessionCookie(t *testing.T, baseURL string) *http.Cookie {
 		}
 		return nil
 	}}
-	response, err := client.Get(baseURL + "/api/v1/auth/oidc/login?returnTo=%2Fapi%2Fv1%2Fme")
+	response, err := client.Get(baseURL + "/api/v1/auth/oidc/login?contextType=tenant&returnTo=%2Fapi%2Fv1%2Fme")
 	if err != nil {
 		t.Fatalf("complete OIDC BFF login: %v", err)
 	}
@@ -463,7 +482,8 @@ func signedOIDCJITToken(t *testing.T, key *ecdsa.PrivateKey, issuer string, subj
 	t.Helper()
 	now := time.Now()
 	claims := jwt.MapClaims{
-		"iss": issuer, "aud": "gateway-api", "sub": subject, "tid": oidcJITTenantID,
+		"iss": issuer, "aud": "gateway-api", "sub": subject, "context_type": "tenant", "tid": oidcJITTenantID,
+		"client_id":          "gateway-public-test",
 		"preferred_username": "oidc-jit-acceptance", "roles": []string{"gateway.admin"},
 		"scope": "openid gateway.access", "iat": now.Unix(), "nbf": now.Add(-time.Second).Unix(),
 		"exp": now.Add(time.Hour).Unix(),