- Add validateAuth() method: calls /api/me to verify token validity,
clears Auth state on 401/login error
- route() now calls validateAuth() async for ALL protected pages
BEFORE showing layout/sidebar/rendering content
- Extract _doRoute() for actual page rendering (runs after validation)
- init() uses API.get for install check (proper auth handling)
- Added reset() to Auth: clears localStorage without redirecting
This fixes: expired token showing login-required pages, and no feedback
when session expires mid-session.
canglan
e232f3b02e