feat: 登录改用 JWT（access token + refresh token），不再用 cookie

- 登录返回 15 分钟的 access token（HS256，密钥 JWT_SECRET，未配置则每次启动随机）
  和 14 天的 refresh token；请求带 Authorization: Bearer，WebSocket 用 ?token=
- refresh token 只存 sha256，放在新表 auth_refresh_token（删除旧的 auth_session）；
  POST /account/refresh 换新的 access token，退出、改密码、封号时作废
- 带了无效或过期的 token 一律 401，前端据此刷新：快过期时提前刷新、并发请求只刷新一次，
  401 时刷新后重试一次，refresh token 也失效才退出登录
- 不再用 cookie，去掉 CORS credentials 和写请求的 Origin 校验

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

client/src/store/guidance.ts

@@ -1,5 +1,5 @@
 import { ref } from "vue"
-import { WS_BASE_URL } from "../utils/const"
+import { wsUrl } from "../token"
 
 export interface GuidanceMessage {
   role: "user" | "assistant"
@@ -17,6 +17,18 @@ export const initialPrompt = ref("")
 
 let ws: WebSocket | null = null
 let _taskId = 0
+// 取 token 要等一下，期间又重连或关闭时作废这次连接
+let connectSeq = 0
+
+async function connect(taskId: number) {
+  if (ws) ws.close()
+  ws = null
+  const seq = ++connectSeq
+  const url = await wsUrl(`/ws/guidance/${taskId}/`)
+  if (seq !== connectSeq) return
+  ws = new WebSocket(url)
+  setupHandlers(ws)
+}
 
 function setupHandlers(socket: WebSocket) {
   socket.onopen = () => {
@@ -69,9 +81,7 @@ export function openGuidance(taskId: number, prompt: string) {
   streamingContent.value = ""
   isOpen.value = true
 
-  if (ws) ws.close()
-  ws = new WebSocket(`${WS_BASE_URL}/ws/guidance/${taskId}/`)
-  setupHandlers(ws)
+  connect(taskId)
 }
 
 export function sendGuidance(content: string) {
@@ -88,14 +98,13 @@ export function stopGuidance() {
   streaming.value = false
   streamingContent.value = ""
   if (_taskId) {
-    if (ws) ws.close()
-    ws = new WebSocket(`${WS_BASE_URL}/ws/guidance/${_taskId}/`)
     initialPrompt.value = ""
-    setupHandlers(ws)
+    connect(_taskId)
   }
 }
 
 export function closeGuidance() {
+  connectSeq++
   if (ws) {
     ws.close()
     ws = null

client/src/store/prompt.ts

@@ -1,5 +1,5 @@
 import { ref } from "vue"
-import { WS_BASE_URL } from "../utils/const"
+import { wsUrl } from "../token"
 import { html, css, js } from "./editors"
 
 export interface PromptMessage {
@@ -29,12 +29,18 @@ export function setOnCodeComplete(fn: typeof _onCodeComplete) {
 }
 
 let ws: WebSocket | null = null
+// 取 token 要等一下，期间又连了别的题或断开时作废这次连接
+let connectSeq = 0
 
-export function connectPrompt(taskId: number) {
+export async function connectPrompt(taskId: number) {
   currentTaskId.value = taskId
   if (ws) ws.close()
+  ws = null
 
-  ws = new WebSocket(`${WS_BASE_URL}/ws/prompt/${taskId}/`)
+  const seq = ++connectSeq
+  const url = await wsUrl(`/ws/prompt/${taskId}/`)
+  if (seq !== connectSeq) return
+  ws = new WebSocket(url)
 
   ws.onopen = () => {
     connected.value = true
@@ -92,6 +98,7 @@ export function connectPrompt(taskId: number) {
 }
 
 export function disconnectPrompt() {
+  connectSeq++
   if (ws) {
     ws.close()
     ws = null