统一鉴权中心接入(ADR-012):org 重写为 Keycloak 身份 + 角色→端;中间件按路由归属统一判;口令/会话/岗位授权退役;迁移 0032

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015kAzS35kMnZNt4YGgJXtfw

apps/api/src/app/__tests__/testbed-trace.it.test.ts

@@ -77,12 +77,14 @@ beforeAll(async () => {
     await pool.query(`create schema "${schema}"`);
   }
   await migrate(drizzle(pool), { migrationsFolder: migrationsFolder(), migrationsSchema: 'sys' });
-  container = await createContainer(loadConfig({ ...process.env, DATABASE_URL: database.url }));
+  container = await createContainer(
+    loadConfig({ ...process.env, DATABASE_URL: database.url, JCAI_TEST_ACCOUNTS: 'chaihao,ai' }),
+  );
   await container.org.ensureSeeded();
   await seedMvp(container);
-  const { staff } = await container.org.listStaff();
-  chaihao = staff.find((s) => s.account === 'Chaihao')!.id;
-  ai = staff.find((s) => s.account === 'AI')!.id;
+  // 人来自鉴权中心(ADR-012):测试自造身份;测试账号策略给它 TEST 岗 + 独立工作组(整条流归自己)
+  chaihao = (await container.org.registerIdentity({ sub: 'it-chaihao', account: 'chaihao', name: '柴浩', roles: ['admin'] })).id;
+  ai = (await container.org.registerIdentity({ sub: 'it-ai', account: 'ai', name: 'AI', roles: ['admin'] })).id;
 }, 180_000);
 
 afterAll(async () => {