Fix control unauthorized: map strategy 401 to 502 and keep fleet headers on redirect.

Co-authored-by: Cursor <cursoragent@cursor.com>

control/frontend/src/api.ts

@@ -30,10 +30,6 @@ export async function apiFetch<T>(
   const token = getToken();
   if (token) headers.set("Authorization", `Bearer ${token}`);
   const res = await fetch(path, { ...options, headers });
-  if (res.status === 401) {
-    clearSession();
-    throw new Error("unauthorized");
-  }
   const text = await res.text();
   let data: unknown = null;
   try {
@@ -41,6 +37,15 @@ export async function apiFetch<T>(
   } catch {
     data = { detail: text };
   }
+  if (res.status === 401) {
+    // 仅中控自身鉴权失败才清会话；勿把策略机错误当成掉登录
+    clearSession();
+    const detail =
+      typeof data === "object" && data && "detail" in data
+        ? String((data as { detail: unknown }).detail)
+        : "unauthorized";
+    throw new Error(detail || "unauthorized");
+  }
   if (!res.ok) {
     const detail =
       typeof data === "object" && data && "detail" in data
@@ -71,5 +76,7 @@ export type NodeCard = {
   online?: boolean;
   health?: Record<string, unknown> | null;
   fleet?: Record<string, unknown> | null;
+  fleet_ok?: boolean;
+  fleet_error?: string | null;
   error?: string | null;
 };