feat(ssf): 托管机器凭据并支持动态恢复

Gateway 连接表单接收认证中心一次性交付的 machine Client 凭据，后端立即写入 SecretStore，数据库和公开响应只保留引用及公开 Client ID。SSF 管理 Token、Verification 和 RFC 7662 内省统一从动态凭据读取，支持现有连接无重启修复及进程重启恢复，环境变量仅保留为旧部署回退。\n\n验证：go test ./apps/api/...；pnpm nx test web；真实重启、OIDC 登录与 session-revoked 1.29 秒失效验收。

apps/api/internal/auth/oidc_test.go

@@ -138,8 +138,10 @@ func TestOIDCVerifierFailsClosedWhenIntrospectionMarksSessionInactive(t *testing
 	verifier, err := NewOIDCVerifier(OIDCConfig{
 		Issuer: issuer, Audience: "gateway-api", TenantID: "tenant-1", RolePrefix: "gateway.",
 		RequiredScopes: []string{"gateway.access"}, HTTPClient: server.Client(),
-		IntrospectionEnabled: true, IntrospectionClientID: "gateway-api",
-		IntrospectionClientSecret: "introspection-secret",
+		IntrospectionEnabled: true,
+		IntrospectionCredentialProvider: func(context.Context) (string, []byte, error) {
+			return "gateway-api", []byte("introspection-secret"), nil
+		},
 	})
 	if err != nil {
 		t.Fatal(err)