fix(auth): unify site-wide 401/403 semantics (cma-auth-401-403-unify-20260915)

require_auth now uses HTTPBearer(auto_error=False) and raises 401 explicitly
when the Authorization header is missing or non-Bearer, matching
require_auth_401. Unauthenticated requests are 401 for every user endpoint;
authenticated-but-forbidden (cross-entity / role) stays 403.

- app/auth_middleware.py: single optional bearer, 401 on missing token
  (require_auth_401 kept as a compatibility alias)
- tests: update 4 pre-existing cases that asserted 403 without a token
  (test_auth, test_reports, test_kpi_causality, test_expenses,
  test_api_auth_surface_20260914) - intentional behavior change
- add tests/test_auth_401_unification_20260915.py: sample + full sweep
  (all AUTHED GET routes -> 401), invalid token -> 401, cross-entity and
  role-denied still 403, bot channel (X-BOT-KEY) and public paths unchanged

backend/tests/test_auth.py

@@ -61,7 +61,7 @@ class TestAuth:
     def test_me_without_token(self, client: TestClient):
         """无token访问需要认证的接口"""
         resp = client.get("/api/cma/auth/me")
-        assert resp.status_code == 403  # HTTPBearer auto_error
+        assert resp.status_code == 401  # 语义统一(2026-09-15)：未认证=401（原 HTTPBearer auto_error 给 403）
 
     def test_register(self, client: TestClient, db: Session):
         """注册新用户"""