fix(admin): 后台未登录访问 Skills/MCP/Agent 报 Not authenticated\n\n- AdminLayout 增加登录+管理员守卫，无 token 或非 admin 跳 /login\n- api request() 处理 403 Not authenticated/需要管理员权限，清 token 跳登录\n- 根因：FastAPI HTTPBearer 无 token 返回 403 而非 401，前端未处理 403 跳转

frontend/src/api/index.ts

@@ -84,6 +84,16 @@ export async function request<T>(
 
   }
 
+  if (res.status === 403) {
+    const err = await res.json().catch(() => ({ detail: 'Forbidden' }));
+    if (err.detail === 'Not authenticated' || err.detail === '需要管理员权限') {
+      localStorage.removeItem('aiflow_token');
+      localStorage.removeItem('aiflow_user');
+      window.location.href = '/login';
+      throw new Error('未登录或权限不足');
+    }
+  }
+
   if (!res.ok) {
 
     const err = await res.json().catch(() => ({ detail: '请求失败' }));

frontend/src/components/layout/AdminLayout.tsx

@@ -191,6 +191,15 @@ const AdminLayout: React.FC = () => {
 
   const location = useLocation();
 
+  // 后台必须登录且为管理员
+  useEffect(() => {
+    const token = localStorage.getItem('aiflow_token');
+    if (!token || !user || user.role !== 'admin') {
+      logout();
+      navigate('/login', { replace: true });
+    }
+  }, [user, logout, navigate]);
+
   const navCrumb = (() => {
 
     for (const g of adminNavGroups) {