fix(mini-user): persist bind-phone session and stop login bounce

Phone bind discarded the new JWT after account merge, so the next page 401'd back to login. Also harden 401 race, location deny cache, unpaid repay CTA, and finishLoginNavigate.

apps/mini-user/src/lib/auth-nav.ts

@@ -42,24 +42,31 @@ export function goLogin(returnPath?: string, extras?: Record<string, string>) {
 /** 登录成功后回到 return 页，或回退 / 首页 */
 export function finishLoginNavigate(returnTo?: string) {
   const raw = (returnTo || '').trim();
-  const target = raw ? decodeURIComponent(raw) : '';
+  let target = '';
+  try {
+    target = raw ? decodeURIComponent(raw) : '';
+  } catch {
+    target = raw;
+  }
+  // 防止 return 仍指向登录页造成死循环
   const pathOnly = target.split('?')[0];
-
-  if (pathOnly && TAB_PAGES.has(pathOnly)) {
-    Taro.switchTab({ url: pathOnly });
+  if (!pathOnly || pathOnly.includes('/pages/login')) {
+    Taro.reLaunch({ url: '/pages/home/index' });
     return;
   }
-  if (pathOnly && pathOnly.startsWith('/pages/')) {
+
+  if (TAB_PAGES.has(pathOnly)) {
+    Taro.switchTab({ url: pathOnly }).catch(() => {
+      Taro.reLaunch({ url: pathOnly });
+    });
+    return;
+  }
+  if (pathOnly.startsWith('/pages/')) {
     Taro.redirectTo({ url: target }).catch(() => {
       Taro.reLaunch({ url: pathOnly });
     });
     return;
   }
 
-  const pages = Taro.getCurrentPages();
-  if (pages.length > 1) {
-    Taro.navigateBack();
-    return;
-  }
-  Taro.switchTab({ url: '/pages/home/index' });
+  Taro.reLaunch({ url: '/pages/home/index' });
 }