fix(auth): fail loudly on JWT encode error instead of returning empty token

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Server/src/auth.rs

@@ -217,7 +217,7 @@ fn sign(secret: &[u8], username: &str, exp: usize) -> String {
         &claims,
         &EncodingKey::from_secret(secret),
     )
-    .unwrap_or_default()
+    .expect("JWT 编码失败")
 }
 
 /// 用指定密钥校验 JWT（便于测试）。默认校验 `exp`。