fix: require token for upload prefix generation

server/api.py

@@ -566,7 +566,9 @@ async def api_market_upload(file: UploadFile = File(...), name: str = "", catego
                 return {"error": "manifest.json 缺少 name"}
 
             import hashlib, io as _io
-            user_prefix = hashlib.md5(token.encode()).hexdigest()[:6] if token else "anon"
+            if not token:
+                return {"error": "需要登录"}
+            user_prefix = hashlib.md5(token.encode()).hexdigest()[:6]
             manifest_id = f"{user_prefix}__{manifest['id']}"
             manifest['id'] = manifest_id