Fix control unauthorized: map strategy 401 to 502 and keep fleet headers on redirect.

Co-authored-by: Cursor <cursoragent@cursor.com>

control/backend/app/api/nodes.py

@@ -33,6 +33,20 @@ def _http_detail(data: Any) -> str:
     return str(data)
 
 
+def _raise_node_error(code: int, data: Any) -> None:
+    """策略机错误不得用 401 回传，否则中控前端会误清登录态。"""
+    detail = _http_detail(data)
+    if code in (401, 403):
+        raise HTTPException(
+            status_code=502,
+            detail=f"策略机鉴权失败（{detail}）。请在中控重新生成 Token，并到策略机「系统设置→登录账户」保存同一 Token。",
+        )
+    raise HTTPException(
+        status_code=code if 400 <= code < 600 else 502,
+        detail=detail,
+    )
+
+
 class NodeCreate(BaseModel):
     name: str = Field(min_length=1, max_length=64)
     base_url: str = Field(min_length=8, max_length=256)
@@ -74,6 +88,13 @@ async def status_all(_user: Annotated[str, Depends(require_control_user)]) -> di
             code, data = await call_node(node, "GET", "/api/fleet/status")
             if code == 200 and isinstance(data, dict):
                 item["fleet"] = data
+                item["fleet_ok"] = True
+            else:
+                item["fleet_ok"] = False
+                item["fleet_error"] = _http_detail(data) if data else f"HTTP {code}"
+        elif not node.get("token_sealed"):
+            item["fleet_ok"] = False
+            item["fleet_error"] = "未生成 Token"
         items.append(item)
     return {"nodes": items}
 
@@ -178,10 +199,7 @@ async def node_start(
         raise HTTPException(status_code=404, detail="节点不存在")
     code, data = await call_node(node, "POST", "/api/fleet/start")
     if code >= 400:
-        raise HTTPException(
-            status_code=code if 400 <= code < 600 else 502,
-            detail=_http_detail(data),
-        )
+        _raise_node_error(code, data)
     return {"ok": True, "result": data}
 
 
@@ -196,10 +214,7 @@ async def node_pause(
         raise HTTPException(status_code=404, detail="节点不存在")
     code, data = await call_node(node, "POST", "/api/fleet/pause")
     if code >= 400:
-        raise HTTPException(
-            status_code=code if 400 <= code < 600 else 502,
-            detail=_http_detail(data),
-        )
+        _raise_node_error(code, data)
     return {"ok": True, "result": data}
 
 
@@ -214,10 +229,7 @@ async def node_update(
         raise HTTPException(status_code=404, detail="节点不存在")
     code, data = await call_node(node, "POST", "/api/fleet/update")
     if code >= 400:
-        raise HTTPException(
-            status_code=code if 400 <= code < 600 else 502,
-            detail=_http_detail(data),
-        )
+        _raise_node_error(code, data)
     return {"ok": True, "result": data}
 
 
@@ -233,10 +245,7 @@ async def node_login_url(
         raise HTTPException(status_code=404, detail="节点不存在")
     code, data = await call_node(node, "POST", "/api/fleet/issue-login")
     if code >= 400:
-        raise HTTPException(
-            status_code=code if 400 <= code < 600 else 502,
-            detail=_http_detail(data),
-        )
+        _raise_node_error(code, data)
     path = ""
     if isinstance(data, dict):
         path = str(data.get("login_path") or "")