feat: 落地登录纵切——网络层、认证会话与登录/注册/Splash 三页（ADR-003/ADR-004）

- 新增 lib/core/network/：ApiClient（dio 封装，错误信封→类型化异常，base URL 经 --dart-define=PATBOND_API_BASE_URL 注入）、AuthInterceptor（Bearer + 设备标识）、TokenRefresher（单飞刷新，401/40101 重放一次，仅 40102/再 401 清会话）
- 新增 lib/features/auth/：SessionManager（token 只进 flutter_secure_storage）、AuthRepository（login/register/refresh/logout/me，注册带 Idempotency-Key）、Splash（500ms 最短停留/5s 超时/错误态重试+改用账号登录）、登录页与注册页（照 12 号组装稿，错误三层映射，预留区不渲染）
- App 根组件改为认证状态机驱动（Splash↔登录↔主壳 300ms fade）；个人中心退出登录接入真实 logout
- 顺带修复：FIX-1 促销卡渐变改 [primaryStrong, primary]、FIX-2 补 helperStyle: muted、README dart format 命令补 --output=none
- 新增依赖：dio ^5.11.1、flutter_secure_storage ^11.0.0、uuid ^4.6.0
- 门禁：dart format（0 changed）/ flutter analyze（No issues）/ flutter test（30 passed，其中新增 23：TokenRefresher 5 + AuthRepository 10 + 登录页 4 + 注册页 4）

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/app/app.dart

@@ -1,10 +1,20 @@
 import 'package:flutter/material.dart';
+import 'package:patbond_flutter/core/network/api_client.dart';
+import 'package:patbond_flutter/core/network/token_refresher.dart';
 import 'package:patbond_flutter/core/theme/app_theme.dart';
+import 'package:patbond_flutter/features/auth/auth_repository.dart';
+import 'package:patbond_flutter/features/auth/login_page.dart';
+import 'package:patbond_flutter/features/auth/session_manager.dart';
+import 'package:patbond_flutter/features/auth/splash_page.dart';
 import 'package:patbond_flutter/features/main/main_shell_page.dart';
 import 'package:patbond_flutter/state/app_state.dart';
 
 class App extends StatefulWidget {
-  const App({super.key});
+  const App({super.key, this.sessionManager, this.authRepository});
+
+  /// 测试注入口；生产默认走安全存储 + 真实 API。
+  final SessionManager? sessionManager;
+  final AuthRepository? authRepository;
 
   @override
   State<App> createState() => _AppState();
@@ -12,26 +22,80 @@ class App extends StatefulWidget {
 
 class _AppState extends State<App> {
   late final AppState appState;
+  late final SessionManager sessionManager;
+  late final AuthRepository authRepository;
 
   @override
   void initState() {
     super.initState();
     appState = AppState()..load();
+    sessionManager =
+        widget.sessionManager ??
+        SessionManager(store: const SecureTokenStore());
+    authRepository = widget.authRepository ?? _buildRepository();
+  }
+
+  AuthRepository _buildRepository() {
+    final dio = buildPatbondDio(session: sessionManager);
+    final refresher = TokenRefresher(dio: dio, session: sessionManager);
+    final api = ApiClient(
+      dio: dio,
+      session: sessionManager,
+      refresher: refresher,
+    );
+    return ApiAuthRepository(
+      api: api,
+      session: sessionManager,
+      refresher: refresher,
+    );
   }
 
   @override
   void dispose() {
     appState.dispose();
+    if (widget.sessionManager == null) sessionManager.dispose();
     super.dispose();
   }
 
+  Widget _homeForStatus() {
+    switch (sessionManager.status) {
+      case AuthStatus.unknown:
+        return SplashPage(
+          key: const ValueKey('splash'),
+          authRepository: authRepository,
+          sessionManager: sessionManager,
+        );
+      case AuthStatus.unauthenticated:
+        return LoginPage(
+          key: const ValueKey('login'),
+          authRepository: authRepository,
+        );
+      case AuthStatus.authenticated:
+        return MainShellPage(
+          key: const ValueKey('shell'),
+          appState: appState,
+          onLogout: authRepository.logout,
+        );
+    }
+  }
+
   @override
   Widget build(BuildContext context) {
     return MaterialApp(
       title: 'Patbond',
       debugShowCheckedModeBanner: false,
       theme: buildAppTheme(),
-      home: MainShellPage(appState: appState),
+      home: ListenableBuilder(
+        listenable: sessionManager,
+        builder: (context, _) {
+          // 认证状态切换统一 300ms 淡入淡出（Splash ↔ 登录 ↔ 主壳，
+          // BrandMark 同构保证品牌区过渡对位，组装稿 §7）。
+          return AnimatedSwitcher(
+            duration: const Duration(milliseconds: 300),
+            child: _homeForStatus(),
+          );
+        },
+      ),
     );
   }
 }