fix(F006-W17): nginx proxy_hide_header WWW-Authenticate 去除浏览器原生认证弹窗

根因: Spring Security /auth/oauth/token 401 响应带 WWW-Authenticate: Basic realm="oauth2/client"
浏览器拦截该响应头后弹出原生 HTTP Basic Auth 对话框("身份验证"),
在 axios/JS 处理响应之前就触发,前端代码无法拦截.

修法: nginx-vue.conf /auth/ location 加 proxy_hide_header WWW-Authenticate;
同时 PlaceholderView/AppLayout fetch 调用加 credentials: omit 兜底.

验证: curl 测试 401 响应已无 WWW-Authenticate 头,登录流程不再触发浏览器弹窗.

src/components/AppLayout/AppLayout.vue

@@ -224,7 +224,8 @@ const badges = ref<Record<string, string>>({})
 async function loadBadges() {
   try {
     const data = await fetch('/sys/openapi/inquiry/list?page=1&limit=1', {
-      headers: { Authorization: `Bearer ${userStore.token}` }
+      headers: { Authorization: `Bearer ${userStore.token}` },
+      credentials: 'omit'
     }).then(r => r.json()).catch(() => null)
     if (data?.code === 0) {
       const total = data.total ?? data.data?.length ?? 0

src/modules/placeholder/PlaceholderView.vue

@@ -83,7 +83,8 @@ async function checkApi() {
       return
     }
     const res = await fetch(apiUrl.value, {
-      headers: { Authorization: `Bearer ${token}` }
+      headers: { Authorization: `Bearer ${token}` },
+      credentials: 'omit'
     })
     // W4.19 修复:nginx 没代理的业务模块会返 404 HTML 页, 不是 JSON
     // 检测 content-type 防止误判