fix(mini-user): persist bind-phone session and stop login bounce

Phone bind discarded the new JWT after account merge, so the next page 401'd back to login. Also harden 401 race, location deny cache, unpaid repay CTA, and finishLoginNavigate.

apps/mini-user/src/pages/login/index.tsx

@@ -66,8 +66,15 @@ export default function LoginPage() {
       setCompleteMode(null);
       return;
     }
+    // 完善资料场景才拉 profile；普通登录勿抢跑 /auth/me，避免旧 token 401 与短信登录竞态
+    if (!needPhone && !needWechat) {
+      setCompleteMode(null);
+      return;
+    }
+    let cancelled = false;
     fetchUserProfile()
       .then((me) => {
+        if (cancelled) return;
         if (needPhone && !me.phoneVerified) {
           setCompleteMode('phone');
           return;
@@ -76,13 +83,14 @@ export default function LoginPage() {
           setCompleteMode('wechat');
           return;
         }
-        if (needPhone || needWechat) {
-          finishLoginNavigate(returnTo);
-          return;
-        }
-        setCompleteMode(null);
+        finishLoginNavigate(returnTo);
       })
-      .catch(() => setCompleteMode(null));
+      .catch(() => {
+        if (!cancelled) setCompleteMode(null);
+      });
+    return () => {
+      cancelled = true;
+    };
   }, [needPhone, needWechat, returnTo]);
 
   useEffect(() => {
@@ -103,6 +111,7 @@ export default function LoginPage() {
     data: SessionPayload | WechatLoginResult,
     phone?: string,
     wxInfo?: MiniWechatProfile | null,
+    successToast = '登录成功',
   ) {
     if (!data.accessToken) return;
     if (phone) saveUserPhone(phone);
@@ -116,7 +125,7 @@ export default function LoginPage() {
         .then((me) => resolveDefaultUserPhone(me))
         .catch(() => {});
     }
-    toast('登录成功', 'success');
+    toast(successToast, 'success');
     finishLoginNavigate(returnTo);
   }
 
@@ -188,19 +197,26 @@ export default function LoginPage() {
         return;
       }
       if (completeMode === 'phone' && isLoggedIn()) {
-        await request('/auth/phone/bind', {
+        // bind 返回新 session（合并账号后旧 guest JWT 立刻失效），必须落盘后再离开
+        const data = await request<SessionPayload>('/auth/phone/bind', {
           method: 'POST',
           data: { phone: normalized, code: code.trim() },
         });
-        saveUserPhone(normalized);
-        toast('手机号验证成功', 'success');
-        finishLoginNavigate(returnTo);
+        if (!data?.accessToken) {
+          setMsg('手机号验证成功但会话未返回，请重新登录');
+          return;
+        }
+        applySessionAndLeave(data, normalized, null, '手机号验证成功');
         return;
       }
       const data = await request<SessionPayload>('/auth/login/sms', {
         method: 'POST',
         data: { phone: normalized, code: code.trim() },
       });
+      if (!data?.accessToken) {
+        setMsg('登录成功但未返回令牌，请重试');
+        return;
+      }
       applySessionAndLeave(data, normalized);
     } catch (e) {
       setMsg(e instanceof Error ? e.message : '登录失败');