feat(web): add authenticated file workflow

- feat: connect login and logout to the REST API with session-scoped tokens, protected routing, single-flight refresh, and authenticated query cache cleanup.
- feat: add the Ant Design application shell with root file listing, pagination, small-file upload, and authenticated download.
- test: cover session storage and API retry and error behavior with Vitest.
- docs: document the browser milestone, same-origin API topology, and deferred transfer and account features.

README.md

@@ -2,7 +2,8 @@
 
 MyGO is a WebDisk (cloud drive) server, written in Go.
 
-**Current status**: pre-alpha — project skeleton with no core functionality implemented yet.
+**Current status**: pre-alpha — basic JWT authentication and file transfer flows
+are available while their APIs and large-file behavior continue to evolve.
 
 ---
 
@@ -11,8 +12,8 @@ MyGO is a WebDisk (cloud drive) server, written in Go.
 ### v0
 
 - [ ] CLI configuration management (`mygo config`)
-- [ ] User authentication (JWT)
-- [ ] File upload / download / management (HTTP API)
+- [x] User authentication (JWT)
+- [x] Basic file upload / download / management (HTTP API)
 - [ ] Admin endpoints
 - [ ] WebDAV support
 
@@ -39,7 +40,9 @@ MyGO is a WebDisk (cloud drive) server, written in Go.
 
 ## Frontend
 
-The frontend uses React + TypeScript and communicates with the backend via HTTP API. Frontend source is maintained in `web/`.
+The frontend uses React + TypeScript and communicates with the backend via HTTP
+API. Its first milestone supports login, a root file list, single-file upload,
+and authenticated download. Frontend source is maintained in `web/`.
 
 ---