feat: R1 重构对称迁移 + 升级依赖 + 配置文件分离

- 命名重构：tenant → customer（对齐后端 R1 重构）
  - Tenant → Customer / tenant_id → customerId
  - tenantStore → customerStore / getTenant/setTenant → getCustomer/setCustomer
  - cookie key tenant → customer, HTTP header tenantId → customerId
- 后端契约更新：AuthResponse 加 sub 字段
- 接口 URL 修复：/auth/oidc/callback → /api/v1/auth/oidc/callback
- 依赖升级：vue 3.5 / element-plus 2.8 / vite 5 / typescript 5.6 / sass 1.79
- 删 node-sass / scss / sass-loader / moment / mock/index.ts
- 配置文件拆分：.env.development / .env.production / .env.example
- 删除冗余 view/auth/auth/callback.vue 副本
- .gitignore 增加 dist / .opencode / tmp
- 新增 AGENT.md 与后端风格对齐

authentik-deploy/04-ingress.yaml

@@ -0,0 +1,27 @@
+# Ingress - 只暴露 server 服务，worker 不需要对外访问
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: authentik
+  namespace: global
+  annotations:
+    kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
+spec:
+  tls:
+    - hosts:
+        - auth.violin-work.online
+      secretName: authentik-tls
+  rules:
+    - host: auth.violin-work.online
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: authentik-server
+                port:
+                  number: 80