fix: site_name not loaded + expired token not cleared

- app.js init(): use native fetch (no Bearer) to call /api/install/status
  and /api/settings/settings, so site_name loads even before login
  state is confirmed; call Auth.reset() if logged but no site_name set
- auth.js: add reset() method that clears TK/US without redirecting
- app.js route(): remove early return for uninstalled; let install check
  run first so init() can fall through to normal routing when installed
- app.js renderMain(): catch 401/login errors from page render, clear
  Auth state, show login prompt with button that redirects back after
  login (target hash preserved)

public/js/app.js

@@ -37,11 +37,25 @@ const App = {
   ],
 
   async init() {
+    // 获取站点名称(无论是否安装),使用原生 fetch 避免携带 Bearer token
+    try {
+      const r = await fetch('/api/install/status');
+      const s = await r.json();
+      if (!s.installed) { location.hash = '#/install'; return; }
+    } catch { location.hash = '#/install'; return; }
+    try {
+      const nameRes = await fetch('/api/settings/settings');
+      if (nameRes.ok) {
+        const settings = await nameRes.json();
+        if (settings.site_name && settings.site_name.value) window.__SITE_NAME__ = settings.site_name.value;
+      }
+    } catch {}
+    // 确保登录态同步:若 cookie 还在但 token 已过期,清除
+    if (Auth.logged() && !window.__SITE_NAME__) Auth.reset();
     if (window.__SITE_NAME__) {
       document.getElementById('site-title').textContent = window.__SITE_NAME__;
       document.getElementById('sidebar-title').textContent = window.__SITE_NAME__ || '举报系统';
     }
-    try { const s = await API.get('/install/status'); if (!s.installed) location.hash = '#/install'; } catch { location.hash = '#/install'; }
     this._footerLoaded = false;
     window.addEventListener('hashchange', () => this.route());
     window.onerror = (msg, url, line, col, err) => {
@@ -180,8 +194,18 @@ const App = {
     document.getElementById('page-title').textContent = title;
     document.getElementById('page-actions').innerHTML = '';
     const ct = document.getElementById('page-content');
+    try {
       ct.innerHTML = await page.render(param);
       if (page.mount) await page.mount(param);
+    } catch (e) {
+      // 401 / 登录过期: 清除状态, 保留访问目标页 hash 提示重新登录
+      if (e && e.message && e.message.includes('登录')) {
+        Auth.reset();
+        const target = location.hash;
+        ct.innerHTML = `<div class="alert alert-e">登录已过期，请重新登录。</div>
+          <div class="mt-2"><button class="btn btn-p" onclick="location.hash='#/login';setTimeout(()=>location.hash='${target}',2000)">去登录</button></div>`;
+      } else throw e;
+    }
   }
 };
 

public/js/auth.js

@@ -42,6 +42,12 @@ const Auth = {
     location.hash = '#/login';
   },
 
+  reset() {
+    // 清除本地登录态但不清除 URL(调用方决定是否跳转)
+    localStorage.removeItem(this.TK);
+    localStorage.removeItem(this.US);
+  },
+
   role(...r) { const u = this.user(); return u && r.includes(u.role); },
   isStaff() { return this.role('owner', 'admin'); },
   isAdmin() { return this.role('owner', 'admin'); },