fix(web): suppress duplicate toasts when auth session expires

Mark 401/refresh-failure errors as handled so per-view catch blocks fall
through silently while a single global "登录已过期" warning is shown.
Centralize ops-web error rendering via showOpsError.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/admin-web/src/lib/api.ts

@@ -193,6 +193,7 @@ function authRequiredError(): ApiClientError {
     message: 'not_authenticated',
     code: 40100,
     status: 401,
+    handled: true,
   })
 }
 
@@ -200,6 +201,13 @@ function expireStoredSession(): void {
   clearStoredSession({ notifyAuthExpired: true })
 }
 
+function markAuthErrorHandled(error: unknown): unknown {
+  if (error instanceof ApiClientError && error.status === 401) {
+    error.handled = true
+  }
+  return error
+}
+
 export function isAuthSessionExpiredError(error: unknown): boolean {
   return error instanceof ApiClientError && error.status === 401
 }
@@ -250,7 +258,7 @@ export async function refreshStoredAuthSession(
 
           expireStoredSession()
         }
-        throw error
+        throw markAuthErrorHandled(error)
       })
       .finally(() => {
         storedRefreshPromise = null
@@ -893,7 +901,7 @@ async function subscribeSSE<TEvent extends SSEEventShape>(
       if (isAuthSessionExpiredError(error)) {
         expireStoredSession()
       }
-      throw error
+      throw markAuthErrorHandled(error)
     }
   }
 
@@ -948,6 +956,7 @@ async function buildSSERequestError(response: Response): Promise<ApiClientError>
         status: response.status,
         detail: payload.detail,
         requestId: payload.request_id,
+        handled: response.status === 401,
       })
     }
   } catch {
@@ -966,6 +975,7 @@ async function buildSSERequestError(response: Response): Promise<ApiClientError>
     message: 'unknown_error',
     status: response.status,
     detail: detail ?? `stream request failed with status ${response.status}`,
+    handled: response.status === 401,
   })
 }