refactor(cma-frontend): route all API calls through shared axios instance (cma-frontend-axios-unify-20260915)

api/index.ts: add permissionApi.getModules/getConfig/saveConfig + alignmentApi.config/tree.

views: replace 13 raw fetch calls and 6 local axios.create instances (each hand-building the Authorization header, without the shared 401 redirect / timeout toast) with the shared instance from api/index.ts.

KPIAlignment: fixes a live bug - the header value was the string literal 'Bearer ' + token, so /alignment/tree always returned 401 (reproduced against the production bundle).

Unwrap semantics preserved: the shared response interceptor returns response.data, so call sites that used res.data were adjusted accordingly.

Verified: scan-frontend-tokenless RAW-TOKENLESS=0; vite build ok; headless A/B (new dist vs production bundle, 8 affected pages, real login) -> identical rendered rows and identical pre-existing error profile, /alignment 401->200.

Push not executed: main is ahead 4 with other tickets' gated commits (see cma-main-ahead3-push-gate-notice-20260915).

frontend/src/views/MpmCalculator.vue

@@ -155,14 +155,8 @@
 <script setup lang="ts">
 import { ref, watch } from 'vue'
 import { ElMessage } from 'element-plus'
-import axios from 'axios'
-
-const api = axios.create({ baseURL: '/api/cma', timeout: 30000 })
-api.interceptors.request.use((config: any) => {
-  const token = localStorage.getItem('cma_token')
-  if (token) config.headers.Authorization = `Bearer ${token}`
-  return config
-})
+// 统一走 api/index.ts 的 axios 实例（拦截器自动带 Bearer / 401 跳登录）
+import api from '../api/index'
 
 // ── 状态 ──
 const period = ref('2026-06')
@@ -243,7 +237,7 @@ async function calculate() {
       })),
     }
     const r = await api.post('/reports/mpm-calculate', payload)
-    result.value = (r as any).data || {}
+    result.value = (r as any) || {}
   } catch (e) {
     ElMessage.error('计算失败，请检查参数')
     result.value = null