Hide manual trade by default, block open while running, auto-refresh auth token.

Also fix flat-side reconcile to check both long and short residuals; document in 更新说明.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_auth_refresh.py

@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+from app.api.auth import issue_token, verify_token
+from app.config import get_settings
+
+
+def test_issue_and_verify_token_roundtrip():
+    s = get_settings()
+    token, ttl = issue_token("admin", s)
+    assert ttl == s.auth_token_ttl_sec
+    assert verify_token(token, s) == "admin"
+
+
+def test_refresh_mints_another_valid_token():
+    s = get_settings()
+    t1, _ = issue_token("admin", s)
+    t2, ttl = issue_token("admin", s)
+    assert ttl > 0
+    assert verify_token(t1, s) == "admin"
+    assert verify_token(t2, s) == "admin"