refactor: auth expiry - sync JWT exp check, remove async validation

Previous async validateAuth() approach caused: recursion loop,
wrong /me path (404 -> session cleared), init() fetching auth-required
settings without token (cleared session every load).

New synchronous approach:
- Auth.expired(): decodes JWT payload locally, checks exp timestamp
- Auth.logged(): token+user exist AND not expired; auto-clears stale
  session on expiry (no network, no async, no loops)
- route(): simple sync guard - if !Auth.logged() reset + redirect to
  #/login; home page stays public (clears stale cookie only)
- API.req: 401 response -> Auth.reset() + redirect to login unless on
  public page (fallback for server-side revocation/invalid signature)
- Removed validateAuth/_validating/_doRoute entirely

public/js/api.js

@@ -34,6 +34,12 @@ const API = {
     const ct = res.headers.get('content-type');
     if (ct && ct.includes('application/json')) {
       const json = await res.json();
+      if (res.status === 401) {
+        // 服务端判定未登录/过期: 清除本地登录态, 非公开页跳转登录
+        Auth.reset();
+        const page = (location.hash || '#/home').replace('#/', '').split('/')[0];
+        if (!['home', 'login', 'register', 'forgot', 'reset', 'verify', 'install'].includes(page)) location.hash = '#/login';
+      }
       if (!res.ok) throw new Error(json.error || '请求失败');
       return json;
     }