[studio] fix: honor configurable login protection in frontend routes

[ai-yang]

Summary

• add a public, non-cacheable GET /api/auth/status endpoint that reports whether login is required and whether the optional bearer token is active
• guard every management route except /login, preserving the frontend-only mock workflow when VITE_USE_MOCK=true
• clear invalid local sessions and redirect to /login; fail closed with a localized retry state when the status request fails
• add backend controller/interceptor coverage and frontend API/route-guard regression tests

Fixes #664. This is the small Track 1 / BASE-01 login-flow unit discussed in #427 and follows up the configurable authentication added by #533. It intentionally does not modify web/src/api/client.ts, avoiding overlap with #662.

Root cause

The backend interceptor honors STUDIO_AUTH_LOGIN_REQUIRED, but the React router had no way to discover that configuration. Unauthenticated users could render management pages, receive 401 responses, and be reloaded to the still-unguarded / route instead of reaching /login.

Verification

• mvn -B -ntp -Dtest=AuthControllerTest,AuthInterceptorTest test — 11 tests passed
• mvn -B -ntp test — 452 tests passed
• mvn -B -ntp checkstyle:check — 0 violations
• npm test -- --run src/api/auth.test.ts src/App.test.tsx — 9 tests passed
• npm run lint — passed (4 existing Fast Refresh warnings)
• npm run build — passed
• containerized production-artifact validation:
  • login disabled: anonymous status returned loginRequired=false; /instance/topic served the SPA
  • login enabled: anonymous status returned authenticated=false; protected API returned 401
  • valid login: status returned authenticated=true; protected API returned 200
  • logged-out token: status returned authenticated=false; protected API returned 401

Existing test-suite issue

The full frontend run completed 232 of 233 tests. The unchanged ClusterPage.test.tsx failed because the page mutates its mock connection count with Math.random() every two seconds while the test asserts the fixed value 1,842; an isolated rerun observed 1,776. The cluster page, its mock data, and that test are unchanged from rocketmq-studio and are outside this PR's scope.

[ai-yang]

Hi maintainers, the CI workflow for this fork PR is currently marked action_required and has not created any jobs.

Could someone with write access please approve and run the workflow when convenient? The local verification results are included in the PR description.

Thank you!