feat(security): JWT 改 HttpOnly Cookie + P2 死依赖清理 + Dockerfile pnpm 化

- #2 JWT HttpOnly Cookie: authSlice/LoginModalContext 不再向 localStorage
  写入 access/refresh/token_type (仅存非敏感 user), 登出/401 时调用
  POST /user/logout/ 清服务端 Cookie; axios withCredentials=true,
  401 无 token 也走 /user/token/refresh/ 空载荷刷新(单飞); WS createWebSocket
  token 参数可省略由 Cookie 鉴权; Navbar/MobileTopNav/Chat/ChatMobile/Bug/
  useRecordHistory 的 localStorage access_token 判断改走登录态
- P2 #10 死依赖清理: 移除 @chakra-ui/react @emotion/react next-themes
  zustand react-lorem-ipsum react-syntax-highlighter qrcode.react
  @types/qrcode; 删 components/ui 整目录与 Markdown/Markdown.tsx;
  删 package-lock.json yarn.lock 仅留 pnpm-lock; untrack tsconfig.tsbuildinfo
- Dockerfile: 弃用 npm install, 改 corepack pnpm@9 --frozen-lockfile
- nginx.conf: API 白名单补 air-quality/weather/currency/shorturl,
  补 /swagger.json 反代

src/pages/Bug/Bug.tsx

@@ -184,8 +184,8 @@ const Bug: React.FC = () => {
   };
 
   const onFinish = async (values: any) => {
-    const token = localStorage.getItem("access_token");
-    if (!token) {
+    const isLogin = !!localStorage.getItem("user") || !!localStorage.getItem("access_token");
+    if (!isLogin) {
       message.warning("请先登录后再提交反馈");
       return;
     }

src/pages/Chat/Chat.tsx

@@ -348,12 +348,14 @@ const Chat: React.FC = () => {
       return;
     }
 
-    const token = localStorage.getItem("access_token");
-    if (!token) {
-      console.error("未找到 access_token");
+    const isLogin = !!localStorage.getItem("user") || !!localStorage.getItem("access_token");
+    if (!isLogin) {
+      console.error("未登录用户无法连接聊天室");
       return;
     }
 
+    const token = localStorage.getItem("access_token") || undefined;
+
     try {
       const ws = createWebSocket(token);
       wsRef.current = ws;

src/pages/Chat/ChatMobile.tsx

@@ -77,10 +77,11 @@ const ChatMobile: React.FC = () => {
   }, [conversationId]);
 
   const connectWebSocket = useCallback(() => {
-    const token = localStorage.getItem("access_token");
-    if (!token || !conversationId) return;
+    const isLogin = !!localStorage.getItem("user") || !!localStorage.getItem("access_token");
+    if (!isLogin || !conversationId) return;
 
-    const cleanToken = token.replace(/^"|"$/g, "");
+    const token = localStorage.getItem("access_token");
+    const cleanToken = token ? token.replace(/^"|"$/g, "") : undefined;
     const ws = createWebSocket(cleanToken);
     wsRef.current = ws;