feat: 企业微信OAuth静默登录

- 新增 GET /api/wecom/oauth-url 和 /api/wecom/oauth-callback
- OAuth回调返回HTML页面直接写localStorage（避坑企微webview 307重定向不可靠）
- 菜单URL改为OAuth静默授权链接（snsapi_base + agentid）
- redirect目标编码到state参数中（避坑redirect_uri不允许自定义query）
- wecom_userid大小写不敏感匹配
- 前端路由守卫处理 ?token= 自动登录（fallback）
- Login.vue企微环境检测自动跳OAuth
- setup-menu同步更新为OAuth链接

Co-Authored-By: Claude <noreply@anthropic.com>

frontend/src/router/index.ts

@@ -80,6 +80,28 @@ const router = createRouter({
 
 router.beforeEach((to, _from, next) => {
   const auth = useAuthStore()
+
+  // Handle WeChat Work OAuth silent login callback: ?token=JWT
+  const tokenParam = to.query.token as string
+  if (tokenParam) {
+    // Save token to auth store (the JWT contains user_id, name, role, theme)
+    try {
+      const payload = JSON.parse(atob(tokenParam.split('.')[1]))
+      auth.saveLogin({
+        access_token: tokenParam,
+        user_id: payload.user_id,
+        name: payload.name,
+        role: payload.role,
+        theme: payload.theme,
+      })
+    } catch (_) { /* invalid token, ignore */ }
+    // Remove token from URL
+    const cleanQuery = { ...to.query }
+    delete cleanQuery.token
+    next({ path: to.path, query: cleanQuery, replace: true })
+    return
+  }
+
   if (to.meta.public) {
     next()
     return