feat(static): add frontend token auto-refresh for dnfs page

- New token_manager.js: silent refresh timer (80% lifetime) + global
  fetch 401 interceptor with one-shot retry.
- dnfs.py /whoami now returns iat, created_at, keep_time for expiry
  estimation.
- Dnfs.html loads token_manager.js before dnfs.js (zero change to dnfs.js).
- Graceful fallback: stale tokens without new fields, refresh failures,
  and /refresh_token 401 itself all degrade to the existing 401→login flow.

dnfs/dnfs.py

@@ -288,11 +288,19 @@ def whoami():
     if info is None:
         return jsonify({'login': False}), 200
 
-    return jsonify({
+    resp = {
         'login': True,
         'user': info.get('user'),
         'is_admin': bool(info.get('is_admin'))
-    }), 200
+    }
+    # 附加 Token 生命周期信息，供前端 Token 管理器估算过期时间
+    if info.get('iat'):
+        resp['iat'] = info['iat']
+    if info.get('created_at'):
+        resp['created_at'] = info['created_at']
+    if info.get('keep_time'):
+        resp['keep_time'] = info['keep_time']
+    return jsonify(resp), 200
 
 
 # eg: {"id": 1}