Fix control unauthorized: map strategy 401 to 502 and keep fleet headers on redirect.

Co-authored-by: Cursor <cursoragent@cursor.com>

control/backend/app/proxy.py

@@ -41,11 +41,20 @@ async def call_node(
         if not tok:
             return 400, {"detail": "该机尚未生成/保存中控 Token"}
         headers["X-Fleet-Token"] = tok
+        headers["Authorization"] = f"Fleet {tok}"
     url = f"{base}{path}"
     timeout = settings.control_http_timeout_sec
     try:
-        async with httpx.AsyncClient(timeout=timeout, follow_redirects=True) as client:
+        async with httpx.AsyncClient(timeout=timeout, follow_redirects=False) as client:
             res = await client.request(method, url, headers=headers, json=json_body)
+            # 少数反代会 301/302 补尾斜杠；手动跟一次并保留 Token 头
+            if res.status_code in (301, 302, 307, 308) and res.headers.get("location"):
+                loc = res.headers["location"]
+                if loc.startswith("/"):
+                    from urllib.parse import urljoin
+
+                    loc = urljoin(url, loc)
+                res = await client.request(method, loc, headers=headers, json=json_body)
             try:
                 data = res.json()
             except Exception: