fix(web): suppress duplicate toasts when auth session expires

Mark 401/refresh-failure errors as handled so per-view catch blocks fall
through silently while a single global "登录已过期" warning is shown.
Centralize ops-web error rendering via showOpsError.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/admin-web/src/lib/errors.ts

@@ -1,5 +1,15 @@
 import { ApiClientError } from '@geo/http-client'
 
+const authSessionErrorMessages = new Set([
+  'not_authenticated',
+  'missing_bearer_token',
+  'invalid_access_token',
+  'invalid_refresh_token',
+  'refresh_session_expired',
+  'refresh_token_mismatch',
+  'token_revoked',
+])
+
 const errorMessageMap: Record<string, string> = {
   invalid_credentials: '邮箱或密码错误',
   login_rate_limited: '登录请求过于频繁',
@@ -79,7 +89,19 @@ const errorMessageMap: Record<string, string> = {
   unknown_error: '发生未知错误',
 }
 
+export function isHandledAuthError(error: unknown): boolean {
+  return (
+    error instanceof ApiClientError &&
+    error.status === 401 &&
+    (error.handled === true || authSessionErrorMessages.has(error.message))
+  )
+}
+
 export function formatError(error: unknown): string {
+  if (isHandledAuthError(error)) {
+    return '登录已过期，请重新登录'
+  }
+
   if (error instanceof ApiClientError) {
     const message = errorMessageMap[error.message] ?? error.message.replaceAll('_', ' ')
     return error.detail ? `${message}: ${error.detail}` : message