feat(tender): 阶段3b 企业登录/注册 + 购买→支付→确认 闭环

- useHjcAuth：token 存 cookie(hjc_token)，login/register/isLoggedIn
- 页面 /login /register（企业名称+密码）
- server/api/tender/{auth/login,auth/register,pay,mark-paid} 代理；order 代理从 cookie 读取 hjc_token 透传 Authorization
- BuyDocument：未登录跳登录；下单→pay(codeUrl)→确认 mark-paid→成功
- types 增 HjcUser

server/api/tender/order.post.ts

@@ -1,18 +1,19 @@
 import { $fetch } from 'ofetch'
-import { createError, defineEventHandler, readBody, getHeader } from 'h3'
+import { createError, defineEventHandler, readBody, getHeader, getCookie } from 'h3'
 import { useRuntimeConfig } from '#imports'
 import { getTenantFromContext } from '../../utils/tenant'
 
 /**
  * 创建标书订单
  * POST /api/tender/order { projectId, quantity, contactName, contactPhone, contactEmail }
- * 代理到 mp-api（mp-java） /api/hjc/order/create；需登录态（Authorization 透传）。
+ * 代理到 mp-api（mp-java） /api/hjc/order/create；需登录态（从 cookie hjc_token 或 Authorization 透传）。
  */
 export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig()
   const ctx = getTenantFromContext(event, config)
   const body = await readBody(event)
-  const auth = getHeader(event, 'authorization')
+  const cookieToken = getCookie(event, 'hjc_token')
+  const auth = getHeader(event, 'authorization') || (cookieToken ? `Bearer ${cookieToken}` : null)
 
   try {
     const res = await $fetch('/hjc/order/create', {