fix: 修复 AI 设计会话失效后的伪登录

问题：Main 刷新令牌返回 401 后已清空会话，但 Renderer 仍保留用户信息，AI 设计持续返回 AUTH_REQUIRED。

实现：认证初始化等待 Main 同步完成；同步或刷新失败清理登录态；Workspace 识别结构化认证错误并在重新登录后恢复加载；路由守卫响应登录状态变化。

验证：49 个聚焦测试通过，TypeScript、聚焦 Lint 与 Vite 生产构建通过。

tests/unit/auth-store.test.ts

@@ -36,21 +36,23 @@ describe('auth store', () => {
   });
 
   it('starts browser authorization through the host api and stores the session', async () => {
-    hostApiFetchMock.mockResolvedValueOnce({
-      success: true,
-      token: {
-        access_token: 'access-token',
-        refresh_token: 'refresh-token',
-        token_type: 'Bearer',
-        expires_in: 60,
-        username: 'zhangsan',
-        user_id: '1',
-        tenant_id: 7,
-        dept_id: 9,
-        authorities: ['ROLE_USER'],
-        client_id: 'app',
-      },
-    });
+    hostApiFetchMock
+      .mockResolvedValueOnce({
+        success: true,
+        token: {
+          access_token: 'access-token',
+          refresh_token: 'refresh-token',
+          token_type: 'Bearer',
+          expires_in: 60,
+          username: 'zhangsan',
+          user_id: '1',
+          tenant_id: 7,
+          dept_id: 9,
+          authorities: ['ROLE_USER'],
+          client_id: 'app',
+        },
+      })
+      .mockResolvedValueOnce({ success: true });
 
     await useAuthStore.getState().loginWithBrowser();
 
@@ -152,6 +154,72 @@ describe('auth store', () => {
     });
   });
 
+  it('waits for Main session sync before marking persisted auth initialized', async () => {
+    let resolveSync!: (value: { success: boolean }) => void;
+    hostApiFetchMock.mockImplementationOnce(() => new Promise((resolve) => {
+      resolveSync = resolve;
+    }));
+    useAuthStore.setState({
+      initialized: false,
+      loading: false,
+      error: null,
+      authBase: 'https://biz.nianxx.cn/auth/',
+      clientId: 'app',
+      accessToken: 'persisted-access-token',
+      refreshToken: 'persisted-refresh-token',
+      tokenType: 'Bearer',
+      expiresAt: Date.now() + 60_000,
+      user: {
+        username: 'zhangsan',
+        userId: '1',
+        tenantId: 7,
+        deptId: 9,
+        authorities: ['ROLE_USER'],
+      },
+    });
+
+    const initialization = useAuthStore.getState().init();
+
+    expect(useAuthStore.getState().initialized).toBe(false);
+
+    resolveSync({ success: true });
+    await initialization;
+
+    expect(useAuthStore.getState().initialized).toBe(true);
+  });
+
+  it('clears persisted renderer auth when Main session sync fails', async () => {
+    hostApiFetchMock.mockRejectedValueOnce(new Error('Host API unavailable'));
+    useAuthStore.setState({
+      initialized: false,
+      loading: false,
+      error: null,
+      authBase: 'https://biz.nianxx.cn/auth/',
+      clientId: 'app',
+      accessToken: 'persisted-access-token',
+      refreshToken: 'persisted-refresh-token',
+      tokenType: 'Bearer',
+      expiresAt: Date.now() + 60_000,
+      user: {
+        username: 'zhangsan',
+        userId: '1',
+        tenantId: 7,
+        deptId: 9,
+        authorities: ['ROLE_USER'],
+      },
+    });
+
+    await useAuthStore.getState().init();
+
+    expect(useAuthStore.getState()).toMatchObject({
+      initialized: true,
+      accessToken: null,
+      refreshToken: null,
+      user: null,
+      error: '登录状态恢复失败，请重新登录。',
+    });
+  });
+
   it('syncs a refreshed session to Main', async () => {
     hostApiFetchMock
       .mockResolvedValueOnce({
@@ -200,6 +268,36 @@ describe('auth store', () => {
     });
   });
 
+  it('clears stale renderer auth when refresh fails', async () => {
+    hostApiFetchMock.mockRejectedValueOnce(new Error('Invalid refresh token'));
+    useAuthStore.setState({
+      initialized: true,
+      loading: false,
+      error: null,
+      authBase: 'https://biz.nianxx.cn/auth/',
+      clientId: 'app',
+      accessToken: 'expired-access-token',
+      refreshToken: 'invalid-refresh-token',
+      tokenType: 'Bearer',
+      expiresAt: Date.now() - 1,
+      user: {
+        username: 'zhangsan',
+        userId: '1',
+        tenantId: 7,
+        deptId: 9,
+        authorities: ['ROLE_USER'],
+      },
+    });
+
+    await expect(useAuthStore.getState().refreshSession()).resolves.toBeNull();
+
+    expect(useAuthStore.getState()).toMatchObject({
+      accessToken: null,
+      refreshToken: null,
+      user: null,
+    });
+  });
+
   it('logs out remotely and clears the local session', async () => {
     hostApiFetchMock.mockResolvedValueOnce({ success: true });
     useAuthStore.setState({