feat: 完整游戏运维功能

platform_web/stores/session.test.ts

@@ -25,9 +25,24 @@ describe("session store helpers", () => {
 
   it("returns null without a stored API session token", async () => {
     stubWindowStorage(new Map());
+    vi.stubGlobal("fetch", vi.fn(async () => jsonResponse({ code: "unauthorized" }, 401)));
     await expect(loadCurrentUser()).resolves.toBeNull();
   });
 
+  it("restores an HttpOnly cookie session without a script-readable token", async () => {
+    const storage = new Map<string, string>();
+    stubWindowStorage(storage);
+    const fetchMock = vi.fn(async (_input: RequestInfo | URL, init?: RequestInit) => {
+      expect(new Headers(init?.headers).has("Authorization")).toBe(false);
+      expect(init?.credentials).toBe("same-origin");
+      return jsonResponse({ id: "user-admin", displayName: "Operator", status: "active", roles: ["platform-admin"] });
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    await expect(loadCurrentUser()).resolves.toMatchObject({ id: "user-admin", source: "api" });
+    expect(storage.size).toBe(0);
+  });
+
   it("loads current user with a stored API bearer token", async () => {
     const storage = new Map([["platform-web.session.apiToken", "session-token"]]);
     stubWindowStorage(storage);