feat: add customer authentication and scoped RBAC

vehicle-data-platform/apps/api/internal/app/identity_adapter.go

@@ -0,0 +1,20 @@
+package app
+
+import (
+	"context"
+
+	"lingniu/vehicle-data-platform/apps/api/internal/platform"
+)
+
+// IdentityAdapter is the narrow trust boundary for a future Yudao Cloud,
+// RuoYi Sys or company SSO integration. Implementations must validate a signed,
+// short-lived credential (or use server-side introspection) before returning a
+// principal. Unsigned forwarding headers must never implement this interface.
+//
+// External identities should be mapped to platform_user through
+// (auth_provider, external_subject); menu and vehicle grants remain platform
+// authorization data so changing an upstream login system cannot bypass Scope.
+type IdentityAdapter interface {
+	Name() string
+	AuthenticateBearer(context.Context, string) (platform.Principal, bool, error)
+}