feat(security): JWT 改 HttpOnly Cookie + P2 死依赖清理 + Dockerfile pnpm 化

- #2 JWT HttpOnly Cookie: authSlice/LoginModalContext 不再向 localStorage
  写入 access/refresh/token_type (仅存非敏感 user), 登出/401 时调用
  POST /user/logout/ 清服务端 Cookie; axios withCredentials=true,
  401 无 token 也走 /user/token/refresh/ 空载荷刷新(单飞); WS createWebSocket
  token 参数可省略由 Cookie 鉴权; Navbar/MobileTopNav/Chat/ChatMobile/Bug/
  useRecordHistory 的 localStorage access_token 判断改走登录态
- P2 #10 死依赖清理: 移除 @chakra-ui/react @emotion/react next-themes
  zustand react-lorem-ipsum react-syntax-highlighter qrcode.react
  @types/qrcode; 删 components/ui 整目录与 Markdown/Markdown.tsx;
  删 package-lock.json yarn.lock 仅留 pnpm-lock; untrack tsconfig.tsbuildinfo
- Dockerfile: 弃用 npm install, 改 corepack pnpm@9 --frozen-lockfile
- nginx.conf: API 白名单补 air-quality/weather/currency/shorturl,
  补 /swagger.json 反代

Dockerfile

@@ -2,17 +2,20 @@ FROM node:20-alpine AS builder
 
 WORKDIR /app
 
-# 复制依赖文件
-COPY package*.json ./
+# 安装并启用 pnpm
+RUN corepack enable && corepack prepare pnpm@9.15.9 --activate
 
-# 安装依赖
-RUN npm install --registry=https://registry.npmmirror.com
+# 复制依赖定义与锁文件
+COPY package.json pnpm-lock.yaml ./
+
+# 冻结安装依赖
+RUN pnpm install --frozen-lockfile --registry=https://registry.npmmirror.com
 
 # 复制项目代码
 COPY . .
 
 # 构建项目
-RUN npm run build
+RUN pnpm run build
 
 FROM nginx:alpine AS production