feat(ssf): 托管机器凭据并支持动态恢复

Gateway 连接表单接收认证中心一次性交付的 machine Client 凭据，后端立即写入 SecretStore，数据库和公开响应只保留引用及公开 Client ID。SSF 管理 Token、Verification 和 RFC 7662 内省统一从动态凭据读取，支持现有连接无重启修复及进程重启恢复，环境变量仅保留为旧部署回退。\n\n验证：go test ./apps/api/...；pnpm nx test web；真实重启、OIDC 登录与 session-revoked 1.29 秒失效验收。

apps/web/src/App.tsx

@@ -1029,12 +1029,12 @@ export function App() {
     }
   }
 
-  async function connectSecurityEvents(transmitterIssuer: string) {
+  async function connectSecurityEvents(transmitterIssuer: string, managementClientId = '', managementClientSecret = '') {
     setCoreState('loading');
     setCoreMessage('');
     try {
       const version = securityEventConnection?.connection?.version;
-      const connection = await connectSecurityEventTransmitter(token, transmitterIssuer, version);
+      const connection = await connectSecurityEventTransmitter(token, transmitterIssuer, managementClientId, managementClientSecret, version);
       setSecurityEventConnection(connection);
       setCoreState('ready');
       setCoreMessage('认证中心安全事件连接正在验证。');