fix(web): suppress duplicate toasts when auth session expires

Mark 401/refresh-failure errors as handled so per-view catch blocks fall
through silently while a single global "登录已过期" warning is shown.
Centralize ops-web error rendering via showOpsError.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/admin-web/src/main.ts

@@ -46,13 +46,14 @@ import {
   Tree,
   TreeSelect,
   Upload,
+  message,
 } from 'ant-design-vue'
 import { createApp } from 'vue'
 
 import 'ant-design-vue/dist/reset.css'
 import App from './App.vue'
 import { i18n } from './i18n'
-import { subscribeAuthExpired } from './lib/session'
+import { subscribeAuthExpired, subscribeStoredSession } from './lib/session'
 import { router } from './router'
 import { pinia } from './stores/pinia'
 import './styles.css'
@@ -68,6 +69,17 @@ const queryClient = new QueryClient({
 })
 
 const app = createApp(App)
+let authExpiredNotified = false
+
+message.config({
+  maxCount: 1,
+})
+
+subscribeStoredSession((snapshot) => {
+  if (snapshot.accessToken) {
+    authExpiredNotified = false
+  }
+})
 
 subscribeAuthExpired(() => {
   const current = router.currentRoute.value
@@ -75,10 +87,15 @@ subscribeAuthExpired(() => {
     return
   }
 
-  void router.replace({
-    name: 'login',
-    query: current.fullPath ? { redirect: current.fullPath } : undefined,
-  })
+  if (!authExpiredNotified) {
+    authExpiredNotified = true
+    message.destroy()
+    message.warning('登录已过期，请重新登录')
+    void router.replace({
+      name: 'login',
+      query: current.fullPath ? { redirect: current.fullPath } : undefined,
+    })
+  }
 })
 
 const IconFont = createFromIconfontCN({