fix(auth): handle expired session sources before permissions

The previous fix only prioritized authStore inside the route guard, so an unauthenticated NextAuth session or a suppressed access-context 401 still collapsed into an empty permission set. Propagate both authentication signals before authorization so expired sessions consistently reauthenticate.

src/components/auth/RoutePermissionGuard.test.tsx

@@ -29,7 +29,7 @@ describe("RoutePermissionGuard", () => {
     });
 
     render(
-      <RoutePermissionGuard>
+      <RoutePermissionGuard authenticated>
         <div>受保护内容</div>
       </RoutePermissionGuard>,
     );
@@ -43,7 +43,7 @@ describe("RoutePermissionGuard", () => {
 
   it("shows the permission error when the session is still valid", () => {
     render(
-      <RoutePermissionGuard>
+      <RoutePermissionGuard authenticated>
         <div>受保护内容</div>
       </RoutePermissionGuard>,
     );
@@ -51,4 +51,15 @@ describe("RoutePermissionGuard", () => {
     expect(screen.getByText("无权访问此功能")).toBeInTheDocument();
     expect(screen.getByText(/simulation\.view/)).toBeInTheDocument();
   });
+
+  it("checks authentication before the expired state effect runs", () => {
+    render(
+      <RoutePermissionGuard authenticated={false}>
+        <div>受保护内容</div>
+      </RoutePermissionGuard>,
+    );
+
+    expect(screen.getByText("登录状态已失效")).toBeInTheDocument();
+    expect(screen.queryByText("无权访问此功能")).not.toBeInTheDocument();
+  });
 });