fix: 路由顺序导致 422 + 彻底消除 Header(...) 隐患

1. devices.py: /tags 和 /export/csv 移到 /{device_id}(int) 之前，
   避免 FastAPI 将 'tags'/'export' 当作 device_id 解析失败返回 422
2. audit.py: /logs/export/csv 移到 /logs/{log_id}(int) 之前，同上
3. auth.py: Header(...) → Header(None)，统一为手动 401 返回，
   消除全局最后一个 Header(...) 导致的 422 隐患

Co-Authored-By: Claude <noreply@anthropic.com>

backend/app/api/v1/auth.py

@@ -84,12 +84,12 @@ def callback(body: CallbackRequest, db: Session = Depends(get_db)):
 
 @router.get("/permissions")
 def get_my_permissions(
-    authorization: str = Header(..., alias="Authorization"),
+    authorization: str = Header(None, alias="Authorization"),
     db: Session = Depends(get_db)
 ):
     """获取当前用户的权限码列表"""
     from app.middleware.permission_middleware import get_role_permissions
-    if not authorization.startswith("Bearer "):
+    if not authorization or not authorization.startswith("Bearer "):
         raise HTTPException(status_code=401, detail="未授权")
     token = authorization[7:]
     payload = verify_token(token)
@@ -102,11 +102,11 @@ def get_my_permissions(
 
 @router.get("/profile")
 def get_profile(
-    authorization: str = Header(..., alias="Authorization"),
+    authorization: str = Header(None, alias="Authorization"),
     db: Session = Depends(get_db)
 ):
     """获取当前用户信息"""
-    if not authorization.startswith("Bearer "):
+    if not authorization or not authorization.startswith("Bearer "):
         raise HTTPException(status_code=401, detail="未授权")
     token = authorization[7:]
     payload = verify_token(token)