fix: 修掉十路审查发现的 9 个 P0 与一批 P1（数据正确性 / 越权 / 现场可用性）

P0（9 条全修）：
- 多通道项目奖牌重复计数：domain 层按 (EventID,CategoryID,EntryID/Subject) 去重，
  通道优先级 athlete→team→id
- 「只排名不计分」项目（scored:false）不再进奖牌榜，REST/WS/导出口径统一
- aggregate 流水 entry_id 恒 NULL 导致重算后分数翻倍：作废范围改按 event+category 定位
- 已发布成绩仍可被「存草稿」覆盖并清空 rank：服务端 409 STATE_INVALID + 前端禁编辑
- voidResult / 规则导入重算后名次不回写：接住 Ranked 调 applyComputedRanks
- 赛事包覆盖导入可能「旧项目已删、新项目没成」：先改名成功再清理，失败回滚
- 导入赛事包可覆盖正在运行的赛事目录：name==当前项目直接 400
- Console spawn 失败后守护器永久卡死：清 child/pid + 调度重启 + stop 超时兜底
- /ws 快照向非 admin 下发 admin-only 配置：按角色裁剪 settings

P1（计分口径 / 契约 / 现场）：
- standings.tieBreak 三处接线；profiles[].recordBonusMode 生效；破纪录校验
  RecordEligible 与 entry 归属；破纪录登记校验已发布成绩
- export.loadRanked 与主路径对齐；ListBackups reason 解析；CLI backup 前缀修正
  （原来只增不减会撑爆磁盘）；单位积分明细/导出统一权重折算；停用单位展示
- 规则导入原子化（重算并入同一事务）+ 返回 compatible/affectedEventCount/
  recalculatedLedgerRows；登录审计 user_id 修正
- WS 策略性断开用 Close(code,reason)；HelloMessage 补 page/instanceId；
  实例注册表清理；settings/单位/项目写操作补 change_log 触发大屏刷新
- 大屏：全量快照不再被版本守卫丢弃；个人积分榜刷新；公告返回页/轮播；行数截断；
  REST 竞态；1008 停止重连；握手超时；时区补 Z；401 仅 AUTH_REQUIRED 才登出
- 管理端：published 行禁编辑；saveDraft 补 unit（1:06.33 显示）；前端预览改用服务端
  points；空成绩行不再恒「已修改」；修订详情按 id 拉取；切项目请求序号与 dirty 保护；
  发布后刷新项目状态；NAV/路由按角色过滤；recorder 不再打 admin-only 接口
- Console：大屏窗口销毁后重建；大屏 URL 复用 host 归一化；backup.bat 改纯 ASCII
  （已在 Meowhome 实跑验证）

自检：服务端 gofmt/build/vet 通过、12 包测试全绿；前端 vue-tsc + build 通过、
node --test 24/24；console check-syntax 12 文件通过。

web/src/shared/api.ts

@@ -1,6 +1,5 @@
 import { isRawBody, isRecord, readString } from './internal'
 import { normalizeRulePack } from './rules'
-import { isGuestRole } from './session'
 import { parseYaml } from './yaml'
 import type {
   AdjustmentInput,
@@ -30,8 +29,6 @@ import type {
   Result,
   ResultQuery,
   RulePack,
-  RulePackImportPreview,
-  RulePackImportResult,
   RuleSwitches,
   SaveDraftPayload,
   ScoreChannel,
@@ -113,7 +110,9 @@ export interface CrudApi<T, Input> {
   list(): Promise<T[]>
   get(id: number): Promise<T>
   create(input: Input): Promise<T>
-  update(id: number, input: Partial<Input>): Promise<T>
+  // 服务端 PUT 是整行覆盖（repo.go 的 UPDATE 写全部列），局部更新会把未传字段清空，
+  // 所以这里要求完整 input，不能声明成 Partial。
+  update(id: number, input: Input): Promise<T>
   remove(id: number): Promise<void>
 }
 
@@ -180,11 +179,7 @@ export interface ExportQuery {
 export interface ExportApi {
   /** 返回可直接放进 <a download> 的地址，省掉一次内存中的 Blob。 */
   standingsUrl(query?: ExportQuery): string
-  breakdownUrl(query: ExportQuery): string
-  resultsUrl(query?: ExportQuery): string
   standings(query?: ExportQuery): Promise<Blob>
-  breakdown(query: ExportQuery): Promise<Blob>
-  results(query?: ExportQuery): Promise<Blob>
   save(blob: Blob, filename: string): void
 }
 
@@ -197,9 +192,6 @@ export interface RulesApi {
   get(): Promise<RulePack>
   /** GET /api/rules/switches，recorder 可读的布尔开关（不含规则内容）。 */
   switches(): Promise<RuleSwitches>
-  /** 先预览差异，再决定是否落地（02 第 7.3 节硬性要求）。 */
-  preview(pack: RulePack): Promise<RulePackImportPreview>
-  apply(pack: RulePack): Promise<RulePackImportResult>
 }
 
 export interface SystemApi {
@@ -256,18 +248,12 @@ function createResultsApi(http: Http): ResultsApi {
 }
 
 function createExportApi(http: Http): ExportApi {
-  const path = {
-    standings: '/export/standings.xlsx',
-    breakdown: '/export/breakdown.xlsx',
-    results: '/export/results.xlsx',
-  }
+  // 服务端只注册了 /export/standings.xlsx 与 /export/all.xlsx 等；
+  // 单位明细 / 分项成绩导出分别是 /export/teams/{id}、/export/events/{id}，由各自页面拼地址。
+  const standingsPath = '/export/standings.xlsx'
   return {
-    standingsUrl: (query) => http.url(path.standings, query),
-    breakdownUrl: (query) => http.url(path.breakdown, query),
-    resultsUrl: (query) => http.url(path.results, query),
-    standings: (query) => http.blob(path.standings, { query }),
-    breakdown: (query) => http.blob(path.breakdown, { query }),
-    results: (query) => http.blob(path.results, { query }),
+    standingsUrl: (query) => http.url(standingsPath, query),
+    standings: (query) => http.blob(standingsPath, { query }),
     save: (blob, filename) => {
       const url = URL.createObjectURL(blob)
       const anchor = document.createElement('a')
@@ -299,14 +285,6 @@ function createRulesApi(http: Http): RulesApi {
       return pack
     },
     switches: () => http.request<RuleSwitches>('/rules/switches'),
-    preview: (pack) =>
-      http.request<RulePackImportPreview>('/rules/import', {
-        method: 'POST',
-        query: { preview: 1 },
-        body: pack,
-      }),
-    apply: (pack) =>
-      http.request<RulePackImportResult>('/rules/import', { method: 'POST', body: pack }),
   }
 }
 
@@ -371,21 +349,19 @@ export class ApiClient {
     }
 
     this.auth = {
-      login: async (username, password) =>
-        markGuest(
-          await http.request<CurrentUser>('/auth/login', {
-            method: 'POST',
-            body: { username, password },
-          }),
-        ),
+      login: (username, password) =>
+        http.request<CurrentUser>('/auth/login', {
+          method: 'POST',
+          body: { username, password },
+        }),
       changePassword: (currentPassword, newPassword) =>
         http.request<{ relogin: boolean }>('/auth/password', {
           method: 'POST',
           body: { currentPassword, newPassword },
         }),
       logout: () => http.requestVoid('/auth/logout', { method: 'POST' }),
-      // 未登录时服务端回 200 + guest DTO，这里补出 guest 标记供 isGuestUser 判定。
-      me: async () => markGuest(await http.request<CurrentUser>('/auth/me')),
+      // 未登录时服务端回 200 + guest DTO，调用方用 isGuestUser(user) 判定，不能只看 null。
+      me: () => http.request<CurrentUser>('/auth/me'),
     }
 
     this.settings = {
@@ -469,12 +445,20 @@ export class ApiClient {
     this.unwrap<unknown>(body)
   }
 
+  /**
+   * 401 也用于「原密码不正确」等业务失败（服务端回 AUTH_FAILED）。
+   * 只有会话缺失 / 过期（AUTH_REQUIRED）才需要通知调用方清空登录态。
+   */
+  private notifyUnauthorized(error: ApiError): void {
+    if (error.code === 'AUTH_REQUIRED') this.onUnauthorized?.(error)
+  }
+
   private async requestJson(path: string, options: RequestOptions = {}): Promise<unknown> {
     const response = await this.send(path, options)
     const body = await readBody(response)
     if (response.status === 401) {
       const error = this.toApiError(body, response.status)
-      this.onUnauthorized?.(error)
+      this.notifyUnauthorized(error)
       throw error
     }
     if (!response.ok) throw this.toApiError(body, response.status)
@@ -488,7 +472,7 @@ export class ApiClient {
       const body = await readBody(response)
       if (response.status === 401) {
         const error = this.toApiError(body, response.status)
-        this.onUnauthorized?.(error)
+        this.notifyUnauthorized(error)
         throw error
       }
       throw this.toApiError(body, response.status)
@@ -502,7 +486,7 @@ export class ApiClient {
       const body = await readBody(response)
       if (response.status === 401) {
         const error = this.toApiError(body, response.status)
-        this.onUnauthorized?.(error)
+        this.notifyUnauthorized(error)
         throw error
       }
       throw this.toApiError(body, response.status)
@@ -536,9 +520,14 @@ export class ApiClient {
     const controller = new AbortController()
     const timer = setTimeout(() => controller.abort(), this.timeoutMs)
     const external = options.signal
+    let abortedByCaller = false
     if (external !== undefined) {
-      if (external.aborted) controller.abort()
-      else external.addEventListener('abort', () => controller.abort(), { once: true })
+      const abortFromCaller = (): void => {
+        abortedByCaller = true
+        controller.abort()
+      }
+      if (external.aborted) abortFromCaller()
+      else external.addEventListener('abort', abortFromCaller, { once: true })
     }
 
     try {
@@ -555,6 +544,8 @@ export class ApiClient {
         signal: controller.signal,
       })
     } catch (error) {
+      // 外部取消与服务端超时共用同一个 signal，必须分开归类，调用方才能决定要不要提示。
+      if (abortedByCaller) throw new ApiError('ABORTED', '请求已取消', 0, error)
       if (controller.signal.aborted) {
         throw new ApiError('TIMEOUT', `请求超时（${this.timeoutMs}ms）`, 0, error)
       }
@@ -620,14 +611,6 @@ function isScalar(value: unknown): value is string | number | boolean {
   return typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean'
 }
 
-/**
- * 服务端未登录时 /auth/me 也回 200 + guest DTO，
- * 这里把 role 结论固化成 guest 字段，调用方用 isGuestUser(user) 判定即可。
- */
-function markGuest(user: CurrentUser): CurrentUser {
-  return { ...user, guest: isGuestRole(user.role) }
-}
-
 async function readBody(response: Response): Promise<unknown> {
   if (response.status === 204) return null
   const text = await response.text()