fix(scripts): push_predictions 支持 JWT 个人访问令牌

服务器上的 Label Studio 关闭了旧式 token（jwt_auth_jwtsettings.legacy_api_tokens_enabled=0），
用 authtoken_token 里的 key 直接请求返回 401。个人访问令牌是 JWT refresh token，
要先 POST /api/token/refresh/ 换成 access token 再以 Bearer 发送。

脚本按令牌形态自动区分：三段点分的按 JWT 换取，否则沿用旧式 Token。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_push_predictions.py

@@ -33,6 +33,10 @@ class _FakeResponse:
         self._payload = payload
         self.status_code = status
 
+    @property
+    def text(self):
+        return str(self._payload)
+
     def json(self):
         return self._payload
 
@@ -86,3 +90,42 @@ def test_tasks_stops_on_empty_page(client):
     client.session = _FakeSession([{"tasks": [{"id": 1}]}, {"tasks": []}])
     assert [t["id"] for t in client.tasks(39)] == [1]
     assert len(client.session.calls) == 2
+
+
+# ---------------- 两种令牌 ----------------
+
+
+class _TokenSession:
+    def __init__(self, access="ACCESS", status=200):
+        self.headers = {}
+        self.access, self.status, self.posted = access, status, []
+
+    def post(self, url, json=None, timeout=None):
+        self.posted.append((url, json))
+        return _FakeResponse({"access": self.access}, self.status)
+
+
+def test_legacy_token_is_sent_as_token(monkeypatch):
+    client = pp.LabelStudio.__new__(pp.LabelStudio)
+    client.url = "http://ls"
+    client.session = _TokenSession()
+    assert client._authorization("c657261234567890") == "Token c657261234567890"
+    assert client.session.posted == []          # 旧式令牌不需要换取
+
+
+def test_jwt_personal_token_is_exchanged_for_a_bearer(monkeypatch):
+    """新版默认禁用旧式 token，个人访问令牌要先换成 access token。"""
+    client = pp.LabelStudio.__new__(pp.LabelStudio)
+    client.url = "http://ls"
+    client.session = _TokenSession(access="AAA")
+    assert client._authorization("aaa.bbb.ccc") == "Bearer AAA"
+    assert client.session.posted[0][0] == "http://ls/api/token/refresh/"
+    assert client.session.posted[0][1] == {"refresh": "aaa.bbb.ccc"}
+
+
+def test_failed_exchange_reports_clearly():
+    client = pp.LabelStudio.__new__(pp.LabelStudio)
+    client.url = "http://ls"
+    client.session = _TokenSession(status=401)
+    with pytest.raises(RuntimeError, match="access token 失败"):
+        client._authorization("aaa.bbb.ccc")