fix: harden user management operations

web/frontend/src/App.tsx

@@ -1,8 +1,8 @@
-import { lazy, Suspense, useState, useCallback, type ReactNode } from 'react';
+import { lazy, Suspense, useState, useCallback, useEffect, type ReactNode } from 'react';
 import { BrowserRouter, Routes, Route, Navigate } from 'react-router-dom';
 import { App as AntdApp, ConfigProvider, Spin, theme } from 'antd';
 import zhCN from 'antd/locale/zh_CN';
-import { getUser } from './store/auth';
+import { fetchCurrentUser, getUser } from './store/auth';
 import { ThemeProvider } from './store/theme';
 import { useTheme } from './store/useTheme';
 import AntdMessageBridge from './utils/AntdMessageBridge';
@@ -44,6 +44,12 @@ function AppContent() {
   const isLoggedIn = !!getUser();
   const { isDark } = useTheme();
 
+  // localStorage 仅是前端缓存；每次加载应用时以服务端的实时权限为准。
+  useEffect(() => {
+    if (!getUser()) return;
+    void fetchCurrentUser().finally(refreshAuth);
+  }, [refreshAuth]);
+
   return (
     <ConfigProvider
       locale={zhCN}