fix(miniapp): persist session token for WeChat login

Return sessionToken from login endpoints and store it client-side because
wx.request cannot rely on Set-Cookie. Also fix multi-cookie parsing,
start on login page, and guard chat rendering fields.

Co-authored-by: Cursor <cursoragent@cursor.com>

server.mjs

@@ -897,7 +897,12 @@ app.post('/auth/login', jsonBody, async (req, res) => {
       return res.status(401).json({ message: result.message });
     }
     setUserLoginCookies(res, req, result.token);
-    return res.json({ authenticated: true, user: result.user, mode: 'user' });
+    return res.json({
+      authenticated: true,
+      user: result.user,
+      mode: 'user',
+      sessionToken: result.token,
+    });
   }
 
   if (!legacyAuth) {
@@ -950,6 +955,7 @@ app.post('/auth/wechat-miniapp/login', jsonBody, async (req, res) => {
       user: result.user,
       mode: 'user',
       isNewUser: Boolean(result.isNewUser),
+      sessionToken: result.token,
     });
   } catch (err) {
     const message = err instanceof Error ? err.message : '微信登录失败';