fix: 将 refresh_path 加入 login_password auth_config 白名单

自定义 refresh 路径会被 normalize_auth_config 丢弃，导致只有默认
/auth/refresh 生效。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/auth_config.py

@@ -12,7 +12,7 @@ AUTH_CONFIG_ALLOWED_KEYS = {
     "cookie": {"cookie_string", "new_api_user", "user_id", "provider"},
     "login_password": {
         "email", "password", "login_path", "username_field", "new_api_user", "user_id", "provider",
-        "token", "refresh_token", "expires_in", "token_expires_at",
+        "token", "refresh_token", "expires_in", "token_expires_at", "refresh_path",
     },
 }