fix(miniprogram): 退出登录后刷新仍保持登录态

根因：logout 清除 storage 期间并发请求触发 tryRefreshToken 写回新 token
修复：添加 isLoggingOut 标记，logout 时先标记阻止 token 刷新竞态

apps/miniprogram/src/services/request.ts

@@ -30,8 +30,18 @@ async function getHeaders(): Promise<Record<string, string>> {
 
 // --- Token refresh deduplication ---
 let refreshPromise: Promise<boolean> | null = null;
+let isLoggingOut = false;
+
+export function markLoggingOut(): void {
+  isLoggingOut = true;
+}
+
+export function clearLoggingOut(): void {
+  isLoggingOut = false;
+}
 
 async function tryRefreshToken(): Promise<boolean> {
+  if (isLoggingOut) return false;
   if (refreshPromise) return refreshPromise;
   refreshPromise = doRefresh();
   refreshPromise.finally(() => { refreshPromise = null; });

apps/miniprogram/src/stores/auth.ts

@@ -2,7 +2,7 @@ import { create } from 'zustand';
 import Taro from '@tarojs/taro';
 import * as authApi from '@/services/auth';
 import { secureGet, secureSet, secureRemove } from '@/utils/secure-storage';
-import { clearRequestCache } from '@/services/request';
+import { clearRequestCache, markLoggingOut, clearLoggingOut } from '@/services/request';
 
 interface BindPhoneResp {
   access_token: string;
@@ -96,6 +96,7 @@ export const useAuthStore = create<AuthState>((set, get) => ({
         secureSet('user_roles', JSON.stringify(roles));
         secureSet('tenant_id', user.tenant_id || '');
         set({ user, roles, loading: false });
+        clearLoggingOut();
         return true;
       }
       secureSet('wechat_openid', resp.openid);
@@ -128,6 +129,7 @@ export const useAuthStore = create<AuthState>((set, get) => ({
       secureSet('tenant_id', tokenData.user?.tenant_id || '');
       secureRemove('wechat_openid');
       set({ user: tokenData.user, roles, loading: false });
+      clearLoggingOut();
       return true;
     } catch (err: any) {
       secureRemove('wechat_openid');
@@ -155,6 +157,7 @@ export const useAuthStore = create<AuthState>((set, get) => ({
   },
 
   logout: () => {
+    markLoggingOut();
     clearRequestCache();
     secureRemove('access_token');
     secureRemove('refresh_token');