Fix control unauthorized: map strategy 401 to 502 and keep fleet headers on redirect.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/fleet.py

@@ -61,6 +61,7 @@ def clear_fleet_token(db=None) -> None:
 
 def require_fleet_token(
     x_fleet_token: Annotated[str | None, Header(alias="X-Fleet-Token")] = None,
+    authorization: Annotated[str | None, Header()] = None,
 ) -> str:
     db = get_db()
     stored = (db.get_setting(_SETTING_HASH, "") or "").strip()
@@ -70,6 +71,10 @@ def require_fleet_token(
             detail="策略机未配置中控 API Token",
         )
     provided = (x_fleet_token or "").strip()
+    if not provided and authorization:
+        auth = authorization.strip()
+        if auth.lower().startswith("fleet "):
+            provided = auth[6:].strip()
     if not provided or not hmac.compare_digest(stored, _hash_token(provided)):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,