fix(game_base): 修复登录注册与 Odoo 18 鉴权对齐 + world.html 登录闸门

- game_api.py: request.session.authenticate 改为 Odoo 18 签名
  authenticate(db, {'type':'password','login':...,'password':...})，
  修复此前多传参数导致的 500 / Access Denied
- game_api.py: 注册成功后先 commit 再自动登录（避免新用户事务未提交导致 Access Denied）
- game_api.py: 登录 authenticate 包 try/except，错误密码返回干净报错而非 500
- world.html: 新增登录闸门——未登录跳转 login.html?next=world.html，
  已登录显示左上角昵称+退出；进入游戏即需登录（与 Odoo 打通）

addons/game_base/controllers/game_api.py

@@ -129,7 +129,11 @@ class GameApiController(http.Controller):
         password = data.get('password') or ''
         if not login or not password:
             return _json({'ok': False, 'error': '账号和密码必填'})
-        uid = request.session.authenticate(db, login, password)
+        try:
+            auth_info = request.session.authenticate(db, {'type': 'password', 'login': login, 'password': password})
+            uid = auth_info['uid']
+        except Exception:
+            return _json({'ok': False, 'error': '账号或密码错误'})
         if uid:
             user = request.env['res.users'].sudo().browse(uid)
             return _json({'ok': True, 'uid': uid, 'name': user.name, 'login': user.login})
@@ -159,8 +163,10 @@ class GameApiController(http.Controller):
                 'password': password,
                 'groups_id': [(6, 0, [portal.id])],
             })
+            request.env.cr.commit()  # 让新用户立即对其他游标可见，便于随后自动登录
             db = request.session.db or 'game'
-            uid = request.session.authenticate(db, login, password)
+            auth_info = request.session.authenticate(db, {'type': 'password', 'login': login, 'password': password})
+            uid = auth_info['uid']
             if uid:
                 return _json({'ok': True, 'uid': uid, 'name': user.name, 'login': user.login})
             return _json({'ok': True, 'uid': user.id, 'name': user.name, 'login': user.login})