feat(auth): интегрировать SSO auth-portal

JWT на backend, handoff/callback на UI, RBAC mm:*, AUTH_* в compose.

Co-authored-by: Cursor <cursoragent@cursor.com>

shared/api/http-client.ts

@@ -1,4 +1,10 @@
 import { configuredBackendUrl } from "@/lib/backend-url"
+import {
+  getToken,
+  isAuthEnabled,
+  redirectToPortalLogin,
+  redirectToPortalLoginInteractive,
+} from "@/lib/auth"
 
 export class ApiClientError extends Error {
   constructor(
@@ -28,14 +34,26 @@ export async function requestJson<T>(
   init?: RequestInit,
 ): Promise<T> {
   const hasBody = init?.body != null
+  const headers = new Headers(init?.headers)
+  if (hasBody && !headers.has("Content-Type")) {
+    headers.set("Content-Type", "application/json")
+  }
+  const token = typeof window !== "undefined" ? getToken() : null
+  if (token && !headers.has("Authorization")) {
+    headers.set("Authorization", `Bearer ${token}`)
+  }
+
   const res = await fetch(resolveRequestUrl(baseUrl, path), {
     ...init,
-    headers: {
-      ...(hasBody ? { "Content-Type": "application/json" } : {}),
-      ...(init?.headers ?? {}),
-    },
+    headers,
   })
 
+  if (res.status === 401 && typeof window !== "undefined" && isAuthEnabled()) {
+    const ok = redirectToPortalLogin()
+    if (!ok) redirectToPortalLoginInteractive()
+    throw new ApiClientError("Unauthorized", 401)
+  }
+
   if (res.status === 204) return undefined as T
 
   const payload = await res.json().catch(() => undefined)