fix: 登录过期改为跳转登录页而非返回 JSON

- Required 中间件区分页面请求(/api/ 前缀)与 SSR 页面请求，页面请求 302 跳转登录页携带 return URL
- 前端 doRefresh token 刷新失败时跳转登录页，避免静默失败
- 认证页面禁止重定向避免无限循环

templates/MetaLab-2026/static/js/common.js

@@ -45,6 +45,13 @@
         }
 
         // ---- Token refresh logic ----
+        function redirectToLogin() {
+            // 避免在认证页面上造成无限跳转循环
+            if (/^\/auth\//.test(window.location.pathname)) return;
+            var returnURL = encodeURIComponent(window.location.pathname + window.location.search);
+            window.location.href = '/auth/login?redirect=' + returnURL;
+        }
+
         function doRefresh() {
             if (isRefreshing) return refreshPromise;
             isRefreshing = true;
@@ -53,11 +60,12 @@
                     isRefreshing = false;
                     refreshPromise = null;
                     if (!res.ok) {
-                        // Refresh failed — clear all pending retries
+                        // Refresh failed — clear all pending retries and redirect to login
                         while (pendingRetries.length) {
                             var r = pendingRetries.shift();
                             r.reject(new Error('refresh_failed'));
                         }
+                        redirectToLogin();
                         return Promise.reject(new Error('refresh_failed'));
                     }
                     // Retry all pending requests
@@ -74,6 +82,7 @@
                         var r2 = pendingRetries.shift();
                         r2.reject(err);
                     }
+                    redirectToLogin();
                     return Promise.reject(err);
                 });
             return refreshPromise;