fix: 修复 AI 设计会话失效后的伪登录

问题：Main 刷新令牌返回 401 后已清空会话，但 Renderer 仍保留用户信息，AI 设计持续返回 AUTH_REQUIRED。

实现：认证初始化等待 Main 同步完成；同步或刷新失败清理登录态；Workspace 识别结构化认证错误并在重新登录后恢复加载；路由守卫响应登录状态变化。

验证：49 个聚焦测试通过，TypeScript、聚焦 Lint 与 Vite 生产构建通过。

tests/unit/image-canvas-page.test.tsx

@@ -3,6 +3,7 @@ import { MemoryRouter } from 'react-router-dom';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { ImageWorkspaceApiError } from '@/lib/image-workspace';
 import { ImageCanvas } from '@/pages/ImageCanvas';
+import { useAuthStore } from '@/stores/auth';
 import { useImageWorkspaceStore } from '@/stores/image-workspace';
 import type {
   DesignGenerationTask,
@@ -152,6 +153,57 @@ describe('ImageCanvas Workspace-first design experience', () => {
     expect(screen.getByText(/暂时无法连接设计服务/)).toBeInTheDocument();
   });
 
+  it('clears stale renderer auth when Main requires authentication', async () => {
+    useAuthStore.setState({
+      initialized: true,
+      loading: false,
+      error: null,
+      accessToken: 'expired-access-token',
+      refreshToken: 'invalid-refresh-token',
+      tokenType: 'Bearer',
+      expiresAt: Date.now() - 1,
+      user: {
+        username: 'brother7',
+        userId: '1',
+        tenantId: null,
+        deptId: null,
+        authorities: [],
+      },
+    });
+    fetchImageWorkspaceMock.mockRejectedValueOnce(new ImageWorkspaceApiError(
+      401,
+      'AUTH_REQUIRED',
+      '请先登录后再使用 AI 设计',
+    ));
+
+    render(<MemoryRouter><ImageCanvas /></MemoryRouter>);
+
+    await screen.findByTestId('image-workspace-unavailable');
+    expect(useAuthStore.getState()).toMatchObject({
+      accessToken: null,
+      refreshToken: null,
+      user: null,
+    });
+    expect(useImageWorkspaceStore.getState().status).toBe('auth-required');
+
+    useAuthStore.setState({
+      accessToken: 'fresh-access-token',
+      refreshToken: 'fresh-refresh-token',
+      tokenType: 'Bearer',
+      expiresAt: Date.now() + 60_000,
+      user: {
+        username: 'brother7',
+        userId: '1',
+        tenantId: null,
+        deptId: null,
+        authorities: [],
+      },
+    });
+
+    await waitFor(() => expect(fetchImageWorkspaceMock).toHaveBeenCalledTimes(2));
+    await waitFor(() => expect(useImageWorkspaceStore.getState().status).toBe('ready'));
+  });
+
   it('renders one fixed design Agent, a Quote, and the unified image/video task list', async () => {
     render(<MemoryRouter><ImageCanvas /></MemoryRouter>);