fix: harden auth flows and align api contracts

internal/api/handler/api_contract_integration_test.go

@@ -368,15 +368,15 @@ func TestProtectedEndpoints_Contract(t *testing.T) {
 // TestHTTPStatusCodes_Contract 验证 HTTP 状态码使用规范
 func TestHTTPStatusCodes_Contract(t *testing.T) {
 	statusCodes := map[int]string{
-		http.StatusOK:                   "成功响应",
-		http.StatusCreated:              "资源创建成功",
-		http.StatusBadRequest:           "请求参数错误",
-		http.StatusUnauthorized:         "未认证",
-		http.StatusForbidden:            "无权限",
-		http.StatusNotFound:             "资源不存在",
-		http.StatusConflict:             "资源冲突",
-		http.StatusTooManyRequests:      "请求过于频繁",
-		http.StatusInternalServerError:  "服务器内部错误",
+		http.StatusOK:                  "成功响应",
+		http.StatusCreated:             "资源创建成功",
+		http.StatusBadRequest:          "请求参数错误",
+		http.StatusUnauthorized:        "未认证",
+		http.StatusForbidden:           "无权限",
+		http.StatusNotFound:            "资源不存在",
+		http.StatusConflict:            "资源冲突",
+		http.StatusTooManyRequests:     "请求过于频繁",
+		http.StatusInternalServerError: "服务器内部错误",
 	}
 
 	for code, desc := range statusCodes {