fix: 189 cloud login reliability, CJK share path, proactive token refresh

[slamdunk111]

Summary

Real-world fixes developed in a long-running fork based on this library, each addressing an observed failure against the live 天翼云盘 (China Telecom 189 cloud) API.

1. Login flow adaptation — cloudpan/login.go, cloudpan/app_login.go

The official login entry point and the embedded form-token regexes have drifted, so password login silently mis-parsed captchaToken / lt / paramId (index-out-of-range panic on FindStringSubmatch(...)[1]) and lost the COOKIE_LOGIN_USER cookie required to obtain the PC session.

• getLoginParams: hit the current unifyLoginForPC.action entry point instead of the removed udb/udb_login.jsp; parse form tokens with regexp.MustCompile + nil-safe len(match) > 1 guards instead of raw [1].
• Login / AppLogin: surface the server message (r.Msg) instead of a generic "登录失败"; capture COOKIE_LOGIN_USER by visiting ToUrl and reading the cookie jar, with a resp.Request().Cookies() fallback.

2. CJK share path — cloudpan/share.go

text.Substr(shareIds, 0, len-1) mis-slices multi-byte (CJK) share ids and can truncate mid-rune. Replaced with strings.TrimSuffix(shareIds, ",") and dropped the library-go/text dependency for this call.

3. Proactive token refresh — cloudpan/app_login.go, cloudpan/api_constant.go

Expose RefreshUserSessionByAccessToken(accessToken) (wraps the existing dead-code getSessionByAccessToken) so callers can renew the PC session with the long-lived accessToken instead of a full password re-login — the frequent password re-login is what triggers 天翼's rate limiting. API_URL is moved from const to var so callers' tests can inject an httptest mock-server URL; runtime value unchanged.

Verification

• go build ./... ✅
• go vet ./... ✅
• cloudpan package tests (app_login_test.go, login_test.go) ✅ pass
• Note: cloudpan/apiutil TestSignatureOfHmac fails on pristine upstream too (a hex-case mismatch), unrelated to this change.