fix: clarify New-API authentication failures

frontend/src/views/Upstreams.vue

@@ -698,6 +698,17 @@ function openAuthCapture() {
   authCaptureVisible.value = true
 }
 
+function isDashboardJwt(value: string): boolean {
+  const token = value.trim()
+  return token.length > 512 && token.split('.').length === 3
+}
+
+function rejectNewApiDashboardJwt(value: string): boolean {
+  if (quickPlatform.value !== 'new-api-user' || !isDashboardJwt(value)) return false
+  ElMessage.warning('提取到的是 New-API 面板登录 JWT，不是长期 Access Token；请在上游 Token 页面生成 API Token')
+  return true
+}
+
 function handleAuthCaptureSelect(candidate: {
   type: string
   value: string
@@ -720,6 +731,7 @@ function handleAuthCaptureSelect(candidate: {
       }
       ElMessage.success('已填入 Nox Access Token')
     } else if (quickPlatform.value === 'new-api-user') {
+      if (rejectNewApiDashboardJwt(candidate.value)) return
       form.value.auth_type = 'new_api_token'
       form.value.auth_config.token = candidate.value
       form.value.auth_config.provider = 'new-api'
@@ -793,6 +805,7 @@ function handleAuthCaptureSelect(candidate: {
     ElMessage.success('已填入 API Key')
   } else if (candidate.type === 'credential') {
     // Try to guess — if value starts with 'sk-', treat as bearer
+    if (rejectNewApiDashboardJwt(candidate.value)) return
     if (candidate.value.startsWith('sk-')) {
       form.value.auth_type = quickPlatform.value === 'nox-api' ? 'nox_token' : quickPlatform.value === 'new-api-user' ? 'new_api_token' : 'bearer'
       form.value.auth_config.token = candidate.value
@@ -1164,6 +1177,10 @@ function openEdit(row: UpstreamData) {
 async function handleSave() {
   const valid = await formRef.value?.validate().catch(() => false)
   if (!valid) return
+  if (form.value.auth_type === 'new_api_token' && isDashboardJwt(String(form.value.auth_config.token || ''))) {
+    ElMessage.warning('New-API 面板登录 JWT 不能作为长期 Access Token；请在上游 Token 页面生成 API Token')
+    return
+  }
   saving.value = true
   try {
     const payload = {