feat(auth): build a unified identity federation architecture

[XiaoSeS]

What to build

Introduce a staged identity federation architecture that keeps protocol verification in provider adapters while centralizing trusted-provider resolution, authority pinning, subject resolution, access/provisioning policy, identity binding, account-state guards, profile synchronization, principal construction, audit, and session creation in SkillHub.

The formal design is tracked in docs/21-unified-identity-federation-design.md and will be reviewed separately before the core migration is merged.

Acceptance criteria

• Existing GitHub, GitLab, OIDC, local password, Device Flow, and API token behavior remains compatible.
• Every external provider returns protocol facts only and cannot directly create accounts, roles, principals, or sessions.
• Provider code is pinned to a normalized authority and mismatches fail closed.
• External subjects are typed; aliases, conflicts, and concurrent first login have explicit rules.
• Email is not used for implicit account takeover or merge.
• Profile sync, identity link, and account merge are independent, auditable policies.
• LDAP/AD, DingTalk, and CAS adapters are implemented only after the shared adapter contract is frozen.
• Each implementation PR is integrated into big-main and validated on the test environment before maintainers consider merging to main.

Delivery order

• P0: close current identity safety gaps.
• P1: unified identity core, Binding V2, profile/provisioning policy, provider registry, identity link, and safe account merge.
• P2: LDAP/AD, DingTalk, and CAS adapters.
• P3: broker guidance and trusted gateway assertions.
• P4: SCIM lifecycle provisioning and explicit entitlement mapping.

Existing requirements remain the source for their protocol slices: #613, #583, #456, and #260. Community PRs #437 and #467 stay open while the shared contract is stabilized.

Blocked by

None - can start immediately.

[github-actions]

Issue Triage

• Route: triage/needs-info
• Priority: priority/p2 (3.2/5)
• Effort: effort/l (4/5)
• Confidence: 1/5
• Risk: high
• Analysis Mode: rules-only

Why

• Touches core SkillHub workflows (review, auth, login).
• Contains urgency signals (cannot).
• Text suggests a bounded change (docs, link).
• Issue is missing key context (problem, proposed solution).

High-Risk Signals

• Mentions sensitive areas (auth).

Missing Info

• Please add problem.
• Please add proposed solution.

Next Action

• Wait for more detail, then rerun triage after the author edits the issue or comments /retriage. Missing: problem, proposed solution.

---

问题分流结果

• 路由: triage/needs-info
• 优先级: priority/p2 (3.2/5)
• 修复投入: effort/l (4/5)
• 信息完整度: 1/5
• 风险: 高
• 分析模式: rules-only

原因

• 涉及 SkillHub 核心流程（review, auth, login）
• 包含紧急信号（cannot）
• 文本显示改动范围较可控（docs, link）
• 缺少关键上下文（problem, proposed solution）

高风险信号

• 提到敏感区域（auth）

缺失信息

• 请补充 problem.
• 请补充 proposed solution.

下一步

• 等待补充更多信息；作者更新 issue 或评论 /retriage 后重新分流