fix: return JSON 401 for unauthenticated API requests instead of redirecting to login route

backend/bootstrap/app.php

@@ -22,5 +22,9 @@ return Application::configure(basePath: dirname(__DIR__))
         // Removed statefulApi() — app uses Bearer token auth, not cookie SPA auth
     })
     ->withExceptions(function (Exceptions $exceptions): void {
-        //
+        $exceptions->render(function (\Illuminate\Auth\AuthenticationException $e, $request) {
+            if ($request->expectsJson() || $request->is('api/*')) {
+                return response()->json(['message' => '未认证，请先登录'], 401);
+            }
+        });
     })->create();