feat(auth): add DingTalk OAuth2 adapter to unified identity core

[XiaoSeS]

Goal

Implement DingTalk OAuth2 as a native Browser Adapter behind the unified identity core.

Scope

• Official DingTalk authorization-code, token, and userinfo transport with bounded timeouts and fail-closed response parsing.
• Stable Provider Instance and authority configuration; authority is never taken from upstream claims.
• Produce ProviderAuthenticationResult with dingtalk_union_id as primary subject and only verified same-response aliases (openId/userId) as typed alternates.
• Map display name, avatar, and email as asserted attributes; ordinary DingTalk email is never verified/authoritative.
• Reuse the existing ExternalIdentityLoginService, Provider Registry, Identity Link, Account Merge, session, audit, and error mapping.
• Add protocol fixtures, conformance tests, callback integration coverage, deployment configuration, docs, and a minimal operator smoke path.

Non-goals

• No direct PlatformPrincipal creation in the adapter.
• No automatic email-based account binding or role mapping.
• No changes to external contributor PR feat(auth): add DingTalk OAuth2 login support #467.
• No main merge until big-main and Hong Kong test-server validation pass.

Acceptance

• Provider disabled or incomplete configuration is hidden and makes no network call.
• Token/userinfo errors, expiry, malformed JSON, missing stable subject, and oversized responses fail closed without secrets in logs.
• Repeated login and username/profile changes resolve the same platform binding.
• Identity Link and Account Merge browser flows use the same provider route and one-time state.
• Exact SHA image is validated on big-main and in an isolated remote deployment.

[github-actions]

Issue Triage

• Route: triage/needs-info
• Priority: priority/p2 (3.0/5)
• Effort: effort/m (3/5)
• Confidence: 2/5
• Risk: high
• Analysis Mode: rules-only

Why

• Touches core SkillHub workflows (auth, login, token).
• Text suggests a bounded change (docs, link).

High-Risk Signals

• Mentions sensitive areas (auth).

Next Action

• Wait for more detail, then rerun triage after the author edits the issue or comments /retriage. Missing: .

---

问题分流结果

• 路由: triage/needs-info
• 优先级: priority/p2 (3.0/5)
• 修复投入: effort/m (3/5)
• 信息完整度: 2/5
• 风险: 高
• 分析模式: rules-only

原因

• 涉及 SkillHub 核心流程（auth, login, token）
• 文本显示改动范围较可控（docs, link）

高风险信号

• 提到敏感区域（auth）

下一步

• 等待补充更多信息；作者更新 issue 或评论 /retriage 后重新分流

[XiaoSeS]

Consolidating the unified identity work back into the parent tracking issue #628 and design PR #630 per maintainer direction. Closing this split delivery item so follow-up discussion and acceptance stay in one place.