fix(auth): 对无 Authorization 的 GraphQL 请求默认匿名放行到解析层，避免 400/403；公开查询仍优先识别后放行

lrj

2 天以前 cacf02681bfdda7926379d37d58ad1a21e398e1a

 backend/src/main/java/com/rongyichuang/config/SecurityConfig.java

@@ -48,9 +48,10 @@
            .csrf(csrf -> csrf.disable())
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**", "/api/actuator/**", "/api/test/**", "/api/cleanup/**").permitAll()
                .requestMatchers("/api/graphql", "/api/graphql/**", "/api/graphiql").permitAll()
                .requestMatchers("/graphql", "/graphql/**").permitAll()
                .requestMatchers("/auth/**", "/actuator/**", "/test/**", "/cleanup/**").permitAll()
                .requestMatchers("/upload/**").permitAll()
                .requestMatchers("/graphiql/**", "/graphql/**", "/api/graphql/**", "/api/graphiql/**").permitAll() // 允许GraphQL和GraphiQL访问
                .requestMatchers("/**/graphql", "/**/graphiql").permitAll() // 更宽泛的GraphQL路径匹配
                .anyRequest().authenticated()
            )
            .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);