Improve Feishu permission checks and OpenVPN auth result page

backend/internal/identityprovider/handlers.go

@@ -222,6 +222,9 @@ func (p *Provider) FeishuCallback(c *gin.Context) {
 		oidcError(c, 503)
 		return
 	}
+	// A successful user-info lookup confirms this application's browser scope.
+	// Do not store user identifiers; reset this evidence when credentials change.
+	_ = store.DB.Model(&model.IdentityProvider{}).Where("id = ? AND app_id = ? AND tenant_key = ?", cfg.ID, cfg.AppID, cfg.TenantKey).Update("user_scope_verified_at", time.Now()).Error
 	u, _ := url.Parse(state.Redirect)
 	q := u.Query()
 	q.Set("code", code)