feat: 登录改用 JWT（access token + refresh token），不再用 cookie

- 登录返回 15 分钟的 access token（HS256，密钥 JWT_SECRET，未配置则每次启动随机）
  和 14 天的 refresh token；请求带 Authorization: Bearer，WebSocket 用 ?token=
- refresh token 只存 sha256，放在新表 auth_refresh_token（删除旧的 auth_session）；
  POST /account/refresh 换新的 access token，退出、改密码、封号时作废
- 带了无效或过期的 token 一律 401，前端据此刷新：快过期时提前刷新、并发请求只刷新一次，
  401 时刷新后重试一次，refresh token 也失效才退出登录
- 不再用 cookie，去掉 CORS credentials 和写请求的 Origin 校验

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/ws.ts

@@ -1,7 +1,6 @@
 import type { Server, ServerWebSocket, WebSocketHandler } from "bun"
-import { config } from "./config"
 import { all, run, iso, uuidOut } from "./db"
-import { parseCookie, userFromSessionKey, type User } from "./auth"
+import { userFromAccessToken, type User } from "./auth"
 import { canAccessTask, getOrCreateActiveConversation, insertMessage } from "./services/prompt"
 import {
   extractCode,
@@ -10,7 +9,6 @@ import {
   streamGuidance,
   type ChatMessage,
 } from "./services/llm"
-import { isAllowedOrigin } from "./origin"
 
 type Kind = "prompt" | "guidance"
 
@@ -34,14 +32,15 @@ type WS = ServerWebSocket<WsData>
 const PATH_RE = /^\/ws\/(prompt|guidance)\/(\d+)\/?$/
 
 // 处理 WebSocket 升级请求；返回 undefined 表示已升级，返回 Response 表示拒绝或不是 ws 路径
-export function upgrade(req: Request, server: Server<WsData>): Response | undefined | null {
+// 浏览器建 WebSocket 时不能加请求头，access token 放在 ?token= 里
+export async function upgrade(
+  req: Request,
+  server: Server<WsData>,
+): Promise<Response | undefined | null> {
   const url = new URL(req.url)
   const match = PATH_RE.exec(url.pathname)
   if (!match) return null
-  if (!isAllowedOrigin(req.headers.get("origin"), req.headers.get("host"))) {
-    return new Response("Forbidden", { status: 403 })
-  }
-  const user = userFromSessionKey(parseCookie(req.headers.get("cookie"), config.sessionCookie))
+  const user = await userFromAccessToken(url.searchParams.get("token"))
   const taskId = Number(match[2])
   if (!user || !canAccessTask(user, taskId)) return new Response("Forbidden", { status: 403 })