fix(auth): handle expired session sources before permissions

The previous fix only prioritized authStore inside the route guard, so an unauthenticated NextAuth session or a suppressed access-context 401 still collapsed into an empty permission set. Propagate both authentication signals before authorization so expired sessions consistently reauthenticate.

src/components/admin/SystemAdminPanel.tsx

@@ -657,7 +657,6 @@ export const SystemAdminPanel = () => {
       try {
         const adminResponse = await apiFetch(`${config.BACKEND_URL}/api/v1/admin/users/me`, {
           projectHeaderMode: "omit",
-          skipAuthRedirect: true,
         });
         if (!adminResponse.ok) {
           if (!cancelled) {

src/components/auth/RoutePermissionGuard.test.tsx

@@ -29,7 +29,7 @@ describe("RoutePermissionGuard", () => {
     });
 
     render(
-      <RoutePermissionGuard>
+      <RoutePermissionGuard authenticated>
         <div>受保护内容</div>
       </RoutePermissionGuard>,
     );
@@ -43,7 +43,7 @@ describe("RoutePermissionGuard", () => {
 
   it("shows the permission error when the session is still valid", () => {
     render(
-      <RoutePermissionGuard>
+      <RoutePermissionGuard authenticated>
         <div>受保护内容</div>
       </RoutePermissionGuard>,
     );
@@ -51,4 +51,15 @@ describe("RoutePermissionGuard", () => {
     expect(screen.getByText("无权访问此功能")).toBeInTheDocument();
     expect(screen.getByText(/simulation\.view/)).toBeInTheDocument();
   });
+
+  it("checks authentication before the expired state effect runs", () => {
+    render(
+      <RoutePermissionGuard authenticated={false}>
+        <div>受保护内容</div>
+      </RoutePermissionGuard>,
+    );
+
+    expect(screen.getByText("登录状态已失效")).toBeInTheDocument();
+    expect(screen.queryByText("无权访问此功能")).not.toBeInTheDocument();
+  });
 });

src/components/auth/RoutePermissionGuard.tsx

@@ -11,8 +11,10 @@ import { useAuthStore } from "@/store/authStore";
 
 export const RoutePermissionGuard = ({
   children,
+  authenticated,
 }: {
   children: ReactNode;
+  authenticated: boolean;
 }) => {
   const pathname = usePathname();
   const permissions = useAccessStore((state) => state.permissions);
@@ -20,7 +22,7 @@ export const RoutePermissionGuard = ({
   const sessionExpired = useAuthStore((state) => state.sessionExpired);
   const requiredPermission = permissionForPath(pathname);
 
-  if (sessionExpired) {
+  if (!authenticated || sessionExpired) {
     return (
       <Box sx={{ p: 3 }}>
         <Alert severity="warning">