feat: 登录改用 JWT（access token + refresh token），不再用 cookie

- 登录返回 15 分钟的 access token（HS256，密钥 JWT_SECRET，未配置则每次启动随机）
  和 14 天的 refresh token；请求带 Authorization: Bearer，WebSocket 用 ?token=
- refresh token 只存 sha256，放在新表 auth_refresh_token（删除旧的 auth_session）；
  POST /account/refresh 换新的 access token，退出、改密码、封号时作废
- 带了无效或过期的 token 一律 401，前端据此刷新：快过期时提前刷新、并发请求只刷新一次，
  401 时刷新后重试一次，refresh token 也失效才退出登录
- 不再用 cookie，去掉 CORS credentials 和写请求的 Origin 校验

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

client/src/api.ts

@@ -25,24 +25,46 @@ import type {
   CreationDetail,
   CreationIn,
 } from "./utils/type"
-import { BASE_URL, STORAGE_KEY } from "./utils/const"
+import { BASE_URL } from "./utils/const"
+import {
+  clearTokens,
+  getAccessToken,
+  getRefreshToken,
+  hasLogin,
+  refreshAccessToken,
+  setTokens,
+} from "./token"
+import { user } from "./store/user"
 
 const http = axios.create({
   baseURL: BASE_URL,
-  xsrfCookieName: "xsrfCookieName",
-  xsrfHeaderName: "X-CSRFTOKEN",
-  withCredentials: true,
+})
+
+http.interceptors.request.use(async (config) => {
+  const token = await getAccessToken()
+  if (token) config.headers.Authorization = `Bearer ${token}`
+  return config
 })
 
 http.interceptors.response.use(
   (res) => {
     return res
   },
-  (err) => {
+  async (err) => {
     if (err.response) {
+      // access token 失效（如服务端重启换了密钥）：刷新一次后重试
+      if (
+        err.response.status === 401 &&
+        hasLogin() &&
+        !err.config._retried
+      ) {
+        err.config._retried = true
+        if (await refreshAccessToken()) return http(err.config)
+      }
       switch (err.response.status) {
         case 401: // 未授权
-          localStorage.removeItem(STORAGE_KEY.LOGIN)
+          clearTokens()
+          user.username = ""
           router.push("/")
           break
         case 403: // 禁止访问
@@ -62,12 +84,14 @@ http.interceptors.response.use(
 export const Account = {
   async login(username: string, password: string) {
     const res = await http.post("/account/login", { username, password })
+    setTokens(res.data)
     return res.data
   },
 
   async logout() {
-    const res = await http.post("/account/logout")
-    return res.data
+    const refresh_token = getRefreshToken()
+    clearTokens()
+    await http.post("/account/logout", { refresh_token })
   },
 
   async getMyProfile() {