refactor: flatten src/AKSRT → src (drop theme-identifier dir)

Move all domain folders from src/AKSRT/{Domain} to src/{Domain}; remap
Composer PSR-4 "AKSRT\\": "src/"; update audit script + README + ADR
paths; remove dead tools/build-psr4-map.php (scanned deleted inc/classes).

src/Identity/CallbackController.php

@@ -0,0 +1,74 @@
+<?php
+/**
+ * Identity provider callback endpoints.
+ *
+ * @package AKSRT
+ */
+
+namespace AKSRT\Identity;
+
+use AKSRT\Identity\Provider\ProviderFactory;
+
+defined('ABSPATH') || exit;
+
+final class CallbackController {
+
+    private const NS = 'aksrt/v1';
+
+    public function register_routes(): void {
+        foreach (['aliyun', 'tencent'] as $provider) {
+            register_rest_route(self::NS, '/identity/callback/' . $provider, [
+                'methods' => $provider === 'aliyun' ? ['GET', 'POST'] : 'POST',
+                'callback' => function (\WP_REST_Request $request) use ($provider): \WP_REST_Response {
+                    return $this->handle($provider, $request);
+                },
+                'permission_callback' => '__return_true',
+            ]);
+        }
+    }
+
+    private function handle(string $provider_key, \WP_REST_Request $request): \WP_REST_Response {
+        $body = $request->get_body();
+        if (strlen($body) > 1024 * 1024) {
+            return new \WP_REST_Response(['success' => false], 413);
+        }
+        $provider = ProviderFactory::make($provider_key);
+        if (!$provider->verify_callback($request)) {
+            return new \WP_REST_Response(['success' => false], 403);
+        }
+        $result = $provider->parse_callback($request);
+        $session = sanitize_text_field((string) ($result->data['provider_session_id'] ?? ''));
+        $outer_order = sanitize_text_field((string) ($result->data['outer_order_no'] ?? ''));
+        if ($session === '' && $outer_order === '') {
+            return new \WP_REST_Response(['success' => false], 422);
+        }
+
+        global $wpdb;
+        $table = \AKSRT\Core\DBMigrator::table('identity_application');
+        if ($session !== '') {
+            $row = $wpdb->get_row($wpdb->prepare(
+                "SELECT * FROM {$table} WHERE provider = %s AND provider_session_id = %s ORDER BY id DESC LIMIT 1",
+                $provider_key,
+                $session
+            ), ARRAY_A);
+        } else {
+            $row = $wpdb->get_row($wpdb->prepare(
+                "SELECT * FROM {$table} WHERE provider = %s AND application_uuid = %s ORDER BY id DESC LIMIT 1",
+                $provider_key,
+                $outer_order
+            ), ARRAY_A);
+        }
+        if (!is_array($row)) {
+            return new \WP_REST_Response(['success' => false], 404);
+        }
+
+        // The callback only wakes server-side reconciliation. A provider query
+        // remains the source of truth for a successful identity decision.
+        $service = new ApplicationService();
+        $response = $service->refresh($row);
+        if (is_wp_error($response)) {
+            return new \WP_REST_Response(['success' => false], 409);
+        }
+        return new \WP_REST_Response(['success' => true]);
+    }
+}