fix(web): wrong current password or TOTP code no longer bounces to login

POST /auth/password and /auth/totp answer 401 for a wrong password/code; the
global 401 handler treated that as an expired session and redirected to /login.
Both mutations now pass noAuthRedirect so the form shows the field error.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/api/auth.ts

@@ -46,7 +46,8 @@ export function useLogout() {
 export function useChangePassword() {
   return useMutation({
     mutationFn: (body: PasswordChangeRequest) =>
-      apiData<PasswordChangeResult>("/auth/password", { method: "POST", body }),
+      // 旧密码错误也是 401:留在页面显示字段错误,不当成会话失效跳登录
+      apiData<PasswordChangeResult>("/auth/password", { method: "POST", body, noAuthRedirect: true }),
   });
 }
 
@@ -61,7 +62,8 @@ export function useTotpStatus(enabled = true) {
 export function useTotpAction() {
   const qc = useQueryClient();
   return useMutation({
-    mutationFn: (body: TotpAction) => apiData<TotpActionResult>("/auth/totp", { method: "POST", body }),
+    mutationFn: (body: TotpAction) =>
+      apiData<TotpActionResult>("/auth/totp", { method: "POST", body, noAuthRedirect: true }),
     onSuccess: () => {
       qc.invalidateQueries({ queryKey: qk.all("auth") });
     },