fix(web): logout-path parity, CSP header, epub display fallback + small review nits

web/src/auth/AuthContext.tsx

@@ -18,8 +18,20 @@ export function AuthProvider({ children }: { children: ReactNode }) {
   const qc = useQueryClient();
   const [token, setTok] = useState<string | null>(() => getToken());
 
+  // 401 到期登出与显式登出同样清理:跨用户数据不得残留在 query 缓存 / SW CacheStorage
+  const clearSession = () => {
+    qc.clear();
+    if (typeof caches !== "undefined") {
+      void caches.delete("booklib-api");
+      void caches.delete("booklib-immutable");
+    }
+  };
+
   useEffect(() => {
-    const off = () => setTok(null); // client 的 401 拦截在这里回收 React 状态
+    const off = () => {
+      setTok(null); // client 的 401 拦截在这里回收 React 状态(token 已由 client.ts 清除)
+      clearSession();
+    };
     window.addEventListener(LOGOUT_EVENT, off);
     return () => window.removeEventListener(LOGOUT_EVENT, off);
   }, []);
@@ -46,11 +58,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
       logout: () => {
         setToken(null);
         setTok(null);
-        qc.clear();
-        if (typeof caches !== "undefined") {
-          void caches.delete("booklib-api");
-          void caches.delete("booklib-immutable");
-        }
+        clearSession();
       },
     }),
     [meQ.data, meQ.isPending, meQ.isError, token, qc],