feat(tender): 阶段3b 企业登录/注册 + 购买→支付→确认 闭环

- useHjcAuth：token 存 cookie(hjc_token)，login/register/isLoggedIn
- 页面 /login /register（企业名称+密码）
- server/api/tender/{auth/login,auth/register,pay,mark-paid} 代理；order 代理从 cookie 读取 hjc_token 透传 Authorization
- BuyDocument：未登录跳登录；下单→pay(codeUrl)→确认 mark-paid→成功
- types 增 HjcUser

app/composables/useHjcAuth.ts

@@ -0,0 +1,47 @@
+import type { HjcUser } from '~/types/tender'
+
+/** 登录态（token 存 cookie，SSR 安全；服务器端代理从 cookie 读取并转发 Authorization） */
+export function useHjcAuth() {
+  const token = useCookie<string | null>('hjc_token', {
+    maxAge: 60 * 60 * 24 * 7,
+    sameSite: 'lax'
+  })
+  const user = useState<HjcUser | null>('hjc-user', () => null)
+
+  function isLoggedIn() {
+    return !!token.value
+  }
+
+  async function login(enterpriseName: string, password: string) {
+    const res: any = await $fetch('/api/tender/login', {
+      method: 'POST',
+      body: { enterpriseName, password }
+    })
+    if (res?.access_token) {
+      token.value = res.access_token
+      user.value = res.user || null
+      return { ok: true, user: res.user }
+    }
+    return { ok: false, message: res?.message || '登录失败' }
+  }
+
+  async function register(payload: Record<string, any>) {
+    const res: any = await $fetch('/api/tender/register', {
+      method: 'POST',
+      body: payload
+    })
+    if (res?.access_token) {
+      token.value = res.access_token
+      user.value = res.user || null
+      return { ok: true, user: res.user }
+    }
+    return { ok: false, message: res?.message || '注册失败' }
+  }
+
+  function logout() {
+    token.value = null
+    user.value = null
+  }
+
+  return { token, user, isLoggedIn, login, register, logout }
+}