fix(mini-user): persist bind-phone session and stop login bounce

Phone bind discarded the new JWT after account merge, so the next page 401'd back to login. Also harden 401 race, location deny cache, unpaid repay CTA, and finishLoginNavigate.

apps/mini-user/src/lib/api.ts

@@ -76,7 +76,18 @@ function parseBody(data: unknown): { code?: number; message?: string } {
   return {};
 }
 
-/** 统一请求：注入 USER_MINI + Bearer，解包 { code, message, data } */
+function isOnLoginPage(): boolean {
+  try {
+    const pages = Taro.getCurrentPages();
+    const cur = pages[pages.length - 1] as { route?: string } | undefined;
+    const route = cur?.route || '';
+    return route.includes('pages/login');
+  } catch {
+    return false;
+  }
+}
+
+/** 统一请求：注入 CLIENT_APP + Bearer，解包 { code, message, data } */
 export async function request<T = unknown>(path: string, options: ReqOptions = {}): Promise<T> {
   const header: Record<string, string> = {
     'Content-Type': 'application/json',
@@ -96,8 +107,12 @@ export async function request<T = unknown>(path: string, options: ReqOptions = {
   const body = parseBody(res.data);
 
   if (status === 401 || body?.code === 401) {
-    clearAuth();
-    redirectToLogin();
+    // 仅清掉「发起本请求时」仍在使用的 token，避免登录页旧 /auth/me 竞态清掉刚写入的新 token
+    const stillCurrent = !!token && getToken() === token;
+    if (stillCurrent) {
+      clearAuth();
+      if (!isOnLoginPage()) redirectToLogin();
+    }
     throw new Error(body?.message || '登录已过期，请重新登录');
   }
   if (status === 404 && body.code === undefined) {