fix(web): remove identity simulation and stop sending X-User-ID

Product UI no longer switches sessions locally; API clients attach Bearer
tokens only and LocalAuthClient stays test-only outside the prod bundle.

web/src/engine/authIntegration.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { createInMemoryAuthClient } from '../api/auth';
+import { createInMemoryAuthClient } from '../api/auth.local';
 import { DEFAULT_ROLES, hasPermission } from './rbac';
 import { UserProfile } from '../types/docgov';
 
@@ -122,22 +122,16 @@ test('全链路场景 3: 管理员开通账号首次强制改密闭环', async (
   assert.equal(freshSession.mustChangePassword, false);
 });
 
-test('全链路场景 4: 环境隔离守卫（dev 允许切人，test/main 彻底禁用）', async () => {
-  // DEV 环境
+test('全链路场景 4: 环境标识随登录会话返回（dev/test/main）', async () => {
   const devClient = createInMemoryAuthClient({ env: 'dev' });
   const devSession = await devClient.login({ username: 'admin', password: 'admin-secret-password-123' });
   assert.equal(devSession.env, 'dev');
-  assert.equal(devSession.allowDevSwitch, true);
 
-  // TEST 环境
   const testClient = createInMemoryAuthClient({ env: 'test' });
   const testSession = await testClient.login({ username: 'admin', password: 'admin-secret-password-123' });
   assert.equal(testSession.env, 'test');
-  assert.equal(testSession.allowDevSwitch, false);
 
-  // MAIN 生产环境
   const prodClient = createInMemoryAuthClient({ env: 'main' });
   const prodSession = await prodClient.login({ username: 'admin', password: 'admin-secret-password-123' });
   assert.equal(prodSession.env, 'main');
-  assert.equal(prodSession.allowDevSwitch, false);
 });