feat(flow): 工作台与轨迹优化 + 管理端启用回路 + 本地验签配置修复

- 已办去重: 同一办件一行 + doneCount 累计次数(FlwTaskRepository 查询去重)
- 发起/撤回/重提留痕事件行(状态码 6/7, 无需 DDL); /oapi/flow/progress steps 含撤回/重提步骤
- 管理端新增启用回路: POST /admin/map/enable/{id}、POST /admin/def/enable/{id}; GET /api/flow/def/source 源码查询
- 修复 findEnabledByOrdId 未过滤 status 的隐性缺陷; 新增 DeptLabelSupport 科室标签支撑
- 测试: FlowEngineIT 撤回留痕/已办去重断言、OapiFlowContractIT 撤回步骤断言(94 tests 全过)
- 本地验签修复: 本地 UserBase 无 context-path, yh.open.services 显式覆盖服务目录枚举兜底的 /userbase basePath, 否则出站签名与服务端剥离不对齐 → GetUserInfo 等全部「验签失败」; 生产经 Caddy 挂 /userbase 时删除 services 覆盖

src/test/java/com/yunhai/flowcenter/oapi/OapiFlowContractIT.java

@@ -199,6 +199,25 @@ class OapiFlowContractIT extends FlowTestSupport {
         assertEquals(40, instanceRepository.findById(instanceId).get().getStatus());
         assertEquals(0, taskRepository.findByInstanceIdAndStatus(instanceId, 0).size(), "待办任务须全部失效");
 
+        // 对外轨迹（progress steps）必须能看到"撤回"这一步（2026-09-18 撤回留痕）
+        JsonNode progress = unwrap(client.get(
+                "/oapi/flow/progress?schId=1&instanceId=" + instanceId, JsonNode.class).getBody());
+        JsonNode steps = progress.get("steps");
+        JsonNode withdrawStep = null;
+        for (JsonNode s : steps) {
+            if ("withdraw".equals(s.get("nodeId").asText())) {
+                withdrawStep = s;
+            }
+        }
+        assertNotNull(withdrawStep, "对外进度须含撤回步骤：" + steps);
+        assertEquals("撤回申请", withdrawStep.get("nodeName").asText());
+        assertEquals("已撤回", withdrawStep.get("label").asText());
+        assertEquals("已撤回", withdrawStep.get("assignees").get(0).get("statusLabel").asText());
+        assertEquals(201, withdrawStep.get("assignees").get(0).get("userId").asInt());
+        // 发起步仍在首位且文案不变（新办件用真实留痕行，老办件走合成步——对外表现一致）
+        assertEquals("submit", steps.get(0).get("nodeId").asText());
+        assertEquals("发起申请", steps.get(0).get("label").asText());
+
         // 重复撤回（已 40）→ 拒绝
         ResponseEntity<JsonNode> again = client.post(
                 "/oapi/flow/instance/" + instanceId + "/withdraw?schId=1&submitterId=201", null, JsonNode.class);