fix: restore jwt login and control-plane checks

console/internal/api/handlers.go

@@ -3,7 +3,6 @@ package api
 import (
 	"bytes"
 	"context"
-	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
@@ -659,26 +658,10 @@ func (s *Server) handleAuth(w http.ResponseWriter, r *http.Request) {
 		env = "test"
 	}
 
-	var ns string
-	if s.testMode {
-		// testMode: токен — это email (sub), Deck не вызывается
-		if !strings.Contains(body.Token, "@") {
-			writeJSONError(w, http.StatusUnauthorized, "invalid token")
-			return
-		}
-		h32 := sha256.Sum256([]byte(body.Token))
-		ns = "fission-" + fmt.Sprintf("%x", h32[:8])
-	} else {
-		if err := s.validateDeckToken(body.Token, env); err != nil {
-			writeJSONError(w, http.StatusUnauthorized, "invalid token")
-			return
-		}
-		var err error
-		ns, err = namespaceFromJWT(body.Token)
-		if err != nil {
-			log.Printf("handleAuth: namespaceFromJWT: %v", err)
-			ns = s.ns
-		}
+	ns, err := s.resolveNamespaceForToken(body.Token, env, s.testMode)
+	if err != nil {
+		writeJSONError(w, http.StatusUnauthorized, "invalid token")
+		return
 	}
 
 	ctx, cancel := context.WithTimeout(r.Context(), 60*time.Second)