fix: GetCurrentUser must check HTTP status and JSON status for token verification

GetCurrentUser() was not checking the HTTP status code or the JSON
"status" field. GitLink returns {"status":401,"message":"无效token"}
as valid JSON, so json.Unmarshal succeeds and the function returns nil
error — making any token appear valid.

Now properly checks HTTP status code, JSON status field, and requires
"login" field in response. If login API tokens fail verification,
shows clear guidance to use private token (--token mode).

Root cause of Windows 401: login API returns session/CSRF token, not
a valid API access_token. The broken verification masked this entirely.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/auth/login.go

@@ -123,10 +123,11 @@ func Login(username, password string) (*LoginResult, error) {
 		}
 	}
 
-	return nil, fmt.Errorf("login succeeded but token verification failed: %w", lastErr)
+	return nil, fmt.Errorf("login succeeded but token verification failed (%v).\n\nPlease use private token instead:\n  1. Visit https://www.gitlink.org.cn/tokens → Create a new token\n  2. Run: gitlink-cli auth login --token\n  3. Paste your private token", lastErr)
 }
 
 // GetCurrentUser fetches the authenticated user info.
+// Returns error if not authenticated or token is invalid.
 func GetCurrentUser() (map[string]interface{}, error) {
 	cfg, err := config.Load()
 	if err != nil {
@@ -145,10 +146,25 @@ func GetCurrentUser() (map[string]interface{}, error) {
 		return nil, err
 	}
 
+	if resp.StatusCode != 200 {
+		return nil, fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(data))
+	}
+
 	var result map[string]interface{}
 	if err := json.Unmarshal(data, &result); err != nil {
 		return nil, err
 	}
 
+	// GitLink returns {"status": -1, "message": "..."} for auth errors with HTTP 200
+	if status, ok := result["status"].(float64); ok && status < 0 {
+		msg, _ := result["message"].(string)
+		return nil, fmt.Errorf("%s", msg)
+	}
+
+	// Verify we got actual user data
+	if _, ok := result["login"]; !ok {
+		return nil, fmt.Errorf("invalid response: missing login field")
+	}
+
 	return result, nil
 }

npm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gitlink-ai/cli",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "GitLink 平台官方命令行工具 — 代码托管、协作开发和自动化",
   "bin": {
     "gitlink-cli": "bin/cli.js",