fix(auth): 完善权限控制与强制改密流程

patient-h5/src/views/entry/EntryView.vue

@@ -25,8 +25,20 @@ async function initialize() {
     getQueryValue(route.query.signToken) ||
     getQueryValue(route.query.t)
 
-  await initializeSignFlow(token)
-  loading.value = false
+  if (token) {
+    const cleanQuery = { ...route.query }
+    delete cleanQuery.token
+    delete cleanQuery.signToken
+    delete cleanQuery.t
+    // 在发起接口请求前清理地址栏，避免一次性凭证进入历史记录、截图或后续 Referer。
+    await router.replace({ path: route.path, query: cleanQuery, hash: route.hash })
+  }
+
+  try {
+    await initializeSignFlow(token)
+  } finally {
+    loading.value = false
+  }
 }
 
 function startSigning() {