refactor(cma-frontend): route all API calls through shared axios instance (cma-frontend-axios-unify-20260915)

api/index.ts: add permissionApi.getModules/getConfig/saveConfig + alignmentApi.config/tree.

views: replace 13 raw fetch calls and 6 local axios.create instances (each hand-building the Authorization header, without the shared 401 redirect / timeout toast) with the shared instance from api/index.ts.

KPIAlignment: fixes a live bug - the header value was the string literal 'Bearer ' + token, so /alignment/tree always returned 401 (reproduced against the production bundle).

Unwrap semantics preserved: the shared response interceptor returns response.data, so call sites that used res.data were adjusted accordingly.

Verified: scan-frontend-tokenless RAW-TOKENLESS=0; vite build ok; headless A/B (new dist vs production bundle, 8 affected pages, real login) -> identical rendered rows and identical pre-existing error profile, /alignment 401->200.

Push not executed: main is ahead 4 with other tickets' gated commits (see cma-main-ahead3-push-gate-notice-20260915).

frontend/src/api/index.ts

@@ -339,10 +339,20 @@ export const roleApi = {
 
 export const permissionApi = {
   getMenuTree: () => api.get('/permissions/menu-tree'),
+  getModules: () => api.get('/permissions/modules'),
+  getConfig: () => api.get('/permissions/config'),
+  saveConfig: (data: any) => api.put('/permissions/config', data),
   getUserRoles: () => api.get('/user-roles'),
   setUserRoles: (data: any) => api.post('/user-roles', data),
 }
 
+// ── KPI目标对齐（/alignment/* 由路由级 require_auth 保护，统一走本实例）──
+export const alignmentApi = {
+  getConfig: () => api.get('/alignment/config'),
+  saveConfig: (data: any) => api.post('/alignment/config', data),
+  getTree: (params?: any) => api.get('/alignment/tree', { params }),
+}
+
 export const kpiCausalityApi = {
   list: (params?: any) => api.get('/kpi-causality', { params }),
   get: (id: number) => api.get(`/kpi-causality/${id}`),