fix: site_name not loaded + expired token not cleared

- app.js init(): use native fetch (no Bearer) to call /api/install/status
  and /api/settings/settings, so site_name loads even before login
  state is confirmed; call Auth.reset() if logged but no site_name set
- auth.js: add reset() method that clears TK/US without redirecting
- app.js route(): remove early return for uninstalled; let install check
  run first so init() can fall through to normal routing when installed
- app.js renderMain(): catch 401/login errors from page render, clear
  Auth state, show login prompt with button that redirects back after
  login (target hash preserved)

public/js/auth.js

@@ -42,6 +42,12 @@ const Auth = {
     location.hash = '#/login';
   },
 
+  reset() {
+    // 清除本地登录态但不清除 URL(调用方决定是否跳转)
+    localStorage.removeItem(this.TK);
+    localStorage.removeItem(this.US);
+  },
+
   role(...r) { const u = this.user(); return u && r.includes(u.role); },
   isStaff() { return this.role('owner', 'admin'); },
   isAdmin() { return this.role('owner', 'admin'); },