feat(app): 完成 P0 钱包解锁、下载落盘与手机号登录

test/auth/auth_controller_test.dart

@@ -165,4 +165,56 @@ void main() {
     expect(auth.isSignedIn, isFalse);
     expect(await AuthSessionStore().read(), isNull);
   });
+
+  test('should_store_session_when_phone_code_login_succeeds', () async {
+    late AuthController auth;
+    final adapter = FakeHttpAdapter((options) async {
+      if (options.uri.path == '/app/auth/otp') {
+        final body = (options.data as Map).cast<String, dynamic>();
+        expect(body['targetType'], 'PHONE');
+        expect(body['target'], '08123456789');
+        expect(body['scene'], 'LOGIN');
+        expect(body['deviceId'], isNotEmpty);
+        return FakeHttpResponse(
+          jsonEncode({'code': 0, 'message': 'ok', 'data': null}),
+        );
+      }
+      expect(options.uri.path, '/app/auth/login');
+      final body = (options.data as Map).cast<String, dynamic>();
+      expect(body['targetType'], 'PHONE');
+      expect(body['code'], '123456');
+      return FakeHttpResponse(tokenBody(accessToken: 'p1', refreshToken: 'pr1'));
+    });
+    final store = AuthSessionStore();
+    auth = AuthController(
+      AuthApi(clientWith(() => auth, adapter: adapter)),
+      store,
+    );
+
+    await auth.sendOtp(target: '08123456789', scene: 'LOGIN');
+    await auth.signInWithPhone(target: '08123456789', code: '123456');
+
+    expect(auth.isSignedIn, isTrue);
+    expect(auth.accessToken, 'p1');
+  });
+
+  test('should_store_session_when_phone_registration_succeeds', () async {
+    late AuthController auth;
+    final adapter = FakeHttpAdapter((options) async {
+      expect(options.uri.path, '/app/auth/register');
+      final body = (options.data as Map).cast<String, dynamic>();
+      expect(body['targetType'], 'PHONE');
+      expect(body['code'], '654321');
+      return FakeHttpResponse(tokenBody(accessToken: 'p2', refreshToken: 'pr2'));
+    });
+    auth = AuthController(
+      AuthApi(clientWith(() => auth, adapter: adapter)),
+      AuthSessionStore(),
+    );
+
+    await auth.registerWithPhone(target: '08123456789', code: '654321');
+
+    expect(auth.isSignedIn, isTrue);
+    expect(auth.user?.uid, 'U1');
+  });
 }