fix(frontend): harden auth request layer per web guide

- fix double-unwrap bug in useLogin prefs sync (theme sync silently broken)
- request layer: 401 single-flight refresh queue + debounced single redirect
  with return-url, cancel-aware silent passthrough, skipErrorHandler opt-out,
  typed blob download (replace bare fetch export in QueriesPage)
- useFetchList: AbortController + version guard + error state (three states)
- ErrorBoundary with chunk-load auto recovery (reload once)
- permission single source: derive route guard from menu constants, drop
  hand-maintained routePermissionMap; TicketDetailPage uses unified
  hasActionPermission instead of inline role string comparison
- namespaced localStorage keys (opsxsql.*) with read-old-write-new migration
- fix pre-existing tsc errors (InstancePage/WorkflowPage/QueriesPage/
  PlatformConfigPage/RedisDetailPage) - typecheck now passes clean

frontend/src/api/auth/auth.ts

@@ -1,7 +1,9 @@
+import axios from 'axios';
 import request from '../request';
 
 export interface LoginResponse {
   access_token: string;
+  refresh_token?: string;
   token_type: string;
   user: {
     id: number;
@@ -27,8 +29,13 @@ export interface MeResponse {
 }
 
 export const authApi = {
+  /** 登录，成功返回 access_token + refresh_token 与用户信息 */
   login: (username: string, password: string) =>
-    request.post<any, LoginResponse>('/auth/login', { username, password }),
-  getMe: () => request.get<any, MeResponse>('/auth/me'),
-  logout: () => request.post('/auth/logout'),
+    request.post<unknown, LoginResponse>('/auth/login', { username, password }),
+  /** 登出并撤销服务端 refresh token；token 参数用于本地凭证已清理时的显式撤销 */
+  logout: (token?: string) =>
+    token
+      ? axios.post('/api/v1/auth/logout', {}, { headers: { Authorization: `Bearer ${token}` } })
+      : request.post('/auth/logout'),
+  getMe: () => request.get<unknown, MeResponse>('/auth/me'),
 };