feat(ssf): 托管机器凭据并支持动态恢复

Gateway 连接表单接收认证中心一次性交付的 machine Client 凭据，后端立即写入 SecretStore，数据库和公开响应只保留引用及公开 Client ID。SSF 管理 Token、Verification 和 RFC 7662 内省统一从动态凭据读取，支持现有连接无重启修复及进程重启恢复，环境变量仅保留为旧部署回退。\n\n验证：go test ./apps/api/...；pnpm nx test web；真实重启、OIDC 登录与 session-revoked 1.29 秒失效验收。

apps/web/src/api.ts

@@ -1007,11 +1007,21 @@ export async function getSecurityEventConnection(token: string): Promise<Securit
   return request<SecurityEventConnectionResponse>(securityEventConnectionPath, { token });
 }
 
-export async function connectSecurityEventTransmitter(token: string, transmitterIssuer: string, version?: number): Promise<SecurityEventConnectionResponse> {
+export async function connectSecurityEventTransmitter(
+  token: string,
+  transmitterIssuer: string,
+  managementClientId: string,
+  managementClientSecret: string,
+  version?: number,
+): Promise<SecurityEventConnectionResponse> {
   const headers: Record<string, string> = { 'Idempotency-Key': `ssf-connect-${crypto.randomUUID()}` };
   if (version !== undefined) headers['If-Match'] = `W/"${version}"`;
   return request<SecurityEventConnectionResponse>(securityEventConnectionPath, {
-    body: { transmitter_issuer: transmitterIssuer }, method: 'PUT', token,
+    body: {
+      transmitter_issuer: transmitterIssuer,
+      management_client_id: managementClientId,
+      management_client_secret: managementClientSecret,
+    }, method: 'PUT', token,
     headers,
   });
 }