feat(auth): introduce unified identity core and provider authority lock

[XiaoSeS]

Background

Implement P1 / PR 1 from #628 and docs/21-unified-identity-federation-design.md after the P0 authentication hardening work.

The current OAuth/OIDC login path is centered on OAuthClaims, while account-state checks and PlatformPrincipal construction are duplicated across external and local login. Provider codes are also not pinned to a stable identity authority.

Scope

• Add the unified identity core value model:
  • ProviderAuthenticationResult
  • core-owned IdentityAssertionFactory / IdentityAssertion
  • ProviderReference, typed ExternalSubject
  • EmailAssurance, AuthenticationEvidence
  • IdentityLoginOutcome
• Add trusted provider route/descriptor resolution for the existing GitHub, GitLab, and OIDC client registrations.
• Add ProviderAuthorityLockService and the additive identity_provider_state Flyway migration.
• Enforce database compare-and-set authority pinning, sticky mismatch, and same-authority explicit recovery.
• Filter AuthMethodCatalog through the trusted descriptor and persisted authority state.
• Add shared AccountLoginGuard and PlatformPrincipalFactory.
• Migrate GitHub/GitLab/OIDC login to ExternalIdentityLoginService.
• Reuse the shared guard and principal factory from local password login.
• Keep the current identity_binding table and existing provisioning behavior for compatibility.
• Keep session creation outside the identity transaction and only accept Authenticated outcomes.

Explicitly out of scope

• LDAP, DingTalk, CAS, SAML, SCIM, trusted-header adapters
• Binding V2 / persisted typed subject aliases
• Dynamic provider registry or runtime plugins
• Full profile sync and provisioning policy redesign
• PlatformPrincipal schema changes

Security invariants

• Provider code, protocol, authority, subject rules, and attribute mappings come only from a trusted server-side descriptor.
• Adapter results cannot select a platform account, role, provider code, authority, or session.
• Authority fingerprint is lowercaseHex(SHA-256(UTF-8(protocol + "\\n" + canonicalAuthority))).
• Authority mismatch fails closed and remains sticky until explicit same-fingerprint recovery or a future audited migration.
• Primary subject is required, typed, bounded, and descriptor-allowed.
• Non-empty aliases fail closed until Binding V2.
• PENDING, DISABLED, MERGED, and system accounts cannot establish an interactive session.
• Tokens, tickets, cookies, credentials, and raw upstream responses never enter the assertion or ordinary audit data.

Acceptance criteria

• Trusted descriptor source rejects unknown/ambiguous providers and authority.
• Fixed authority fingerprint vectors pass.
• First pin, concurrent same-authority pin, restart mismatch, sticky mismatch, and explicit same-authority recovery are tested against compare-and-set behavior.
• Invalid/missing/oversized primary subjects and non-empty aliases fail closed.
• Existing GitHub, GitLab, and generic OIDC login behavior remains compatible.
• Local login uses the shared account guard and principal factory.
• Only IdentityLoginOutcome.Authenticated reaches PlatformSessionService.
• Existing OAuth bindings remain readable and rollback-compatible.
• Relevant backend tests, frontend checks, migration/startup validation, and staging smoke checks pass before merge.

Integration policy

Develop and validate on big-main first. Do not merge directly to main; create a clean-main PR only after prerequisite P0/design commits are present on main and origin/main..HEAD contains only this issue's commits.

[github-actions]

Issue Triage

• Route: triage/needs-info
• Priority: priority/p1 (3.7/5)
• Effort: effort/m (3/5)
• Confidence: 2/5
• Risk: high
• Analysis Mode: rules-only

Why

• Touches core SkillHub workflows (auth, login, token).
• Contains urgency signals (fails, cannot, security).
• Text suggests a bounded change (docs).

High-Risk Signals

• Mentions sensitive areas (auth).

Next Action

• Wait for more detail, then rerun triage after the author edits the issue or comments /retriage. Missing: .

---

问题分流结果

• 路由: triage/needs-info
• 优先级: priority/p1 (3.7/5)
• 修复投入: effort/m (3/5)
• 信息完整度: 2/5
• 风险: 高
• 分析模式: rules-only

原因

• 涉及 SkillHub 核心流程（auth, login, token）
• 包含紧急信号（fails, cannot, security）
• 文本显示改动范围较可控（docs）

高风险信号

• 提到敏感区域（auth）

下一步

• 等待补充更多信息；作者更新 issue 或评论 /retriage 后重新分流