feat(iam): v2 用户管理 RPC + F12 httpOnly Cookie

admin-portal §2.3 P1 阻塞项补齐：CreateUser/UpdateUser/DeleteUser 3 RPC

iam.repository/service/grpc.controller 实现 3 用户管理方法（含 bcrypt + 审计）

iam.controller 新增 POST /v1/iam/users + DELETE /v1/iam/users/:id（@RequirePermission(IAM_USER_MANAGE)）

iam.dto 新增 createUserSchema Zod 校验

F12 httpOnly Cookie：refresh_token 改为 httpOnly+Secure+SameSite=Strict Cookie 下发

extractRefreshToken 优先读 cookie 回退 body + buildRefreshTokenCookie/buildClearCookie

services/iam/src/config/env.ts

@@ -19,6 +19,13 @@ const envSchema = z.object({
   ACCESS_TOKEN_TTL: z.string().default("15m"),
   REFRESH_TOKEN_TTL_DAYS: z.string().default("7"),
 
+  // Cookie（F12 裁决：refresh_token httpOnly cookie 模式）
+  COOKIE_SECURE: z
+    .string()
+    .default("auto")
+    .transform((v) => (v === "auto" ? undefined : v === "true")),
+  COOKIE_DOMAIN: z.string().optional(),
+
   // Kafka（Outbox 投递）
   KAFKA_BROKERS: z.string(),
   KAFKA_CLIENT_ID: z.string().default("iam-service"),