Hide manual trade by default, block open while running, auto-refresh auth token.

Also fix flat-side reconcile to check both long and short residuals; document in 更新说明.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/auth_routes.py

@@ -89,6 +89,22 @@ async def me(
     }
 
 
+@router.post("/refresh", response_model=LoginResponse)
+async def refresh_token(
+    username: Annotated[str, Depends(require_user)],
+    settings: Annotated[Settings, Depends(get_settings)],
+) -> LoginResponse:
+    """用仍有效的 Bearer 换发新 HMAC token（自动轮换，无需重登）。"""
+    token, ttl = issue_token(username, settings)
+    return LoginResponse(
+        token=token,
+        username=username,
+        expires_in=ttl,
+        env_name=settings.env_name,
+        mode=settings.mode,
+    )
+
+
 @router.post("/change-credentials", response_model=LoginResponse)
 async def change_credentials(
     body: ChangeCredentialsRequest,