refactor(登录): 登录态从 Cookie 换成 access token + refresh token

- access token 是 15 分钟的 JWT，走 Authorization: Bearer；refresh token 7 天，每次换都轮换
- 退出登录、改密码、禁用账号仍然立刻生效：每个请求核对 Redis 会话和库里新加的 user.token_version
- 在服务器后台改密码 / 禁用，机房那边登着的也会一起下线（原来两边 Redis 分开，管不到）
- WebSocket 握手借子协议带 token；JWT 密钥存在本站 Redis，部署不用加配置
- 去掉 COOKIE_SECURE；上线后所有人要重新登录一次

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/src/oj/api.ts

@@ -60,6 +60,7 @@ import {
   type TodaySubmissionStatistics,
 } from "@oj2/contract"
 import api from "utils/api"
+import { authFetch } from "utils/auth"
 import { contract } from "utils/contract"
 import { toProblemRow } from "utils/transforms"
 import type {
@@ -532,9 +533,8 @@ export function reportExerciseAttempt(
   exerciseId: number,
   payload: { correct: boolean; answer?: string },
 ) {
-  return fetch(`/api/exercises/${exerciseId}/attempts`, {
+  return authFetch(`/api/exercises/${exerciseId}/attempts`, {
     method: "POST",
-    credentials: "include",
     keepalive: true,
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({
@@ -559,9 +559,8 @@ export function reportLearnProgress(
   tutorialId: number,
   payload: { seconds: number; opened: boolean },
 ) {
-  return fetch(`/api/tutorials/${tutorialId}/progress`, {
+  return authFetch(`/api/tutorials/${tutorialId}/progress`, {
     method: "POST",
-    credentials: "include",
     keepalive: true,
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(payload),