fix(oauth): remove pending oauth auto-binding and enforce oidc policies

- Complete removal of completePendingOAuthBinding logic to prevent unintended account takeovers (AUTH-ROUTE-1).
- Add strict OIDC policy checks (global switch and source active states) across authorization and callback paths (AUTH-POLICY-1).
- Fix OIDC test cases to properly clear the Redis-backed system config cache using composite keys.

internal/apps/user/routers.go

@@ -164,9 +164,6 @@ func Login(c *gin.Context) {
 		return
 	}
 
-	// 检查是否有未完成 of OAuth/OIDC 绑定
-	completePendingOAuthBinding(ctx, session, &user)
-
 	c.JSON(http.StatusOK, util.OK(oauth.BuildBasicUserInfo(&user, needChangePassword)))
 }