feat(app): 完成 P0 钱包解锁、下载落盘与手机号登录

lib/core/data/remote/auth_api.dart

@@ -10,6 +10,67 @@ class AuthApi {
 
   final ApiClient _client;
 
+  /// 发送短信验证码；[scene] 为 REGISTER / LOGIN / RESET_PWD / BIND。
+  Future<void> sendOtp({
+    required String target,
+    required String scene,
+    required String deviceId,
+  }) async {
+    await _client.post(
+      '/app/auth/otp',
+      body: {
+        'scene': scene,
+        'targetType': 'PHONE',
+        'target': target,
+        'deviceId': deviceId,
+      },
+    );
+  }
+
+  /// 手机号 + 验证码登录。
+  Future<AuthSession> loginWithPhone({
+    required String target,
+    required String code,
+    required String deviceId,
+    String platform = '',
+    String appVersion = '',
+  }) async {
+    final data = await _client.post(
+      '/app/auth/login',
+      body: {
+        'targetType': 'PHONE',
+        'target': target,
+        'code': code,
+        'deviceId': deviceId,
+        'platform': platform,
+        'appVersion': appVersion,
+      },
+    );
+    return AuthSession.fromJson((data as Map).cast<String, dynamic>());
+  }
+
+  /// 手机号 + 验证码注册。
+  Future<AuthSession> registerWithPhone({
+    required String target,
+    required String code,
+    required String deviceId,
+    String platform = '',
+    String appVersion = '',
+  }) async {
+    final data = await _client.post(
+      '/app/auth/register',
+      body: {
+        'targetType': 'PHONE',
+        'target': target,
+        'code': code,
+        'deviceId': deviceId,
+        'platform': platform,
+        'appVersion': appVersion,
+      },
+    );
+    return AuthSession.fromJson((data as Map).cast<String, dynamic>());
+  }
+
   Future<AuthSession> register({
     required String email,
     required String password,

lib/core/data/remote/commerce_api.dart

@@ -0,0 +1,23 @@
+// Author: fruit.com.cn
+
+import '../models/wallet.dart';
+import 'api_client.dart';
+
+/// 金币与解锁接口，对应契约 §1.8。
+class CommerceApi {
+  const CommerceApi(this._client);
+
+  final ApiClient _client;
+
+  Future<WalletSnapshot> wallet() async {
+    final data = await _client.get('/app/wallet');
+    if (data is Map<String, dynamic>) return WalletSnapshot.fromJson(data);
+    throw const ApiException(-1, '返回数据格式异常');
+  }
+
+  Future<UnlockResult> unlock(String episodeId) async {
+    final data = await _client.post('/app/episodes/$episodeId/unlock');
+    if (data is Map<String, dynamic>) return UnlockResult.fromJson(data);
+    throw const ApiException(-1, '返回数据格式异常');
+  }
+}