feat(api): P1.4 web token 60min静默刷新—后端POST /auth/refresh(有效旧token换新,过期401不放行续命)+login/refresh返expires_in+get_token_exp;前端请求拦截器剩余<10min单飞预刷新(裸axios避递归/mock短路,失败静默降级走401兜底);治长回测轮询401跳登录;3新测试 [vps]

sanguo_api/auth.py

@@ -38,3 +38,18 @@ def verify_token(token: str) -> str:
         return payload["sub"]
     except jwt.PyJWTError:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="无效 token")
+
+
+def token_expires_in() -> int:
+    """当前配置的 token 有效期(秒),登录/刷新响应的 expires_in。"""
+    return int(_CONFIG["expire_minutes"] * 60)
+
+
+def get_token_exp(token: str) -> int | None:
+    """解析 token 的 exp(unix 秒),不验签(供拦截器判断剩余时间);失败 → None。"""
+    try:
+        payload = jwt.decode(token, options={"verify_signature": False})
+        exp = payload.get("exp")
+        return int(exp) if exp is not None else None
+    except (jwt.PyJWTError, ValueError, TypeError):
+        return None