refactor(client): 网络层由官方 http 换成 dio（对外行为不变）

为什么：权威文档（AGENTS.md / CODING_STANDARDS.md）强制网络层用 dio，差异清单 A 组第 1 题
用户裁定选 A；原来用官方 http 是在无文档状态下按口头要求选的。

- ApiClient 改用 dio + BaseOptions（validateStatus 恒真、8s 超时、ResponseType.bytes 自行 UTF-8 解码）
- 新增 AuthHeaderInterceptor（Authorization / X-Device-Id）与 EnvelopeInterceptor
  （解包 {code,message,data} + 错误码映射 + 401 判定）
- 401 → 刷新 → 重发一次在 ApiClient 里编排，刻意不放在拦截器内重发：dio 的排队拦截器
  在回调里再发请求会自锁
- 接口层（auth_api/catalog_api）签名、全部 controller/logic/page 未改动
- 测试：新增假 dio adapter 替代 MockClient，断言口径一条未改；用例名改为 should_<期望>_when_<条件>；
  新增 api_client_test（解包/错误映射/请求头/查询参数/跳过重试）与 live_auth_test（真实后端 POST 链路）
- pubspec：加 dio、移除已无引用的 http
- 实测：dart analyze lib test 零告警；flutter test 155 全过；真实联调（8081）GET/POST 链路均通

test/core/api_client_test.dart

@@ -0,0 +1,107 @@
+// Author: fruit.com.cn
+
+import 'dart:convert';
+
+import 'package:flutter_test/flutter_test.dart';
+
+import 'package:nontonki/core/data/remote/api_client.dart';
+
+import '../support/fake_http_adapter.dart';
+
+/// 网络层换 dio 之后，把「对外契约」逐条钉住：解包、错误码映射、请求头、查询参数、跳过重试。
+void main() {
+  String envelope(Object? data, {int code = 0, String message = 'ok'}) {
+    return jsonEncode({'code': code, 'message': message, 'data': data});
+  }
+
+  test('should return the data field when the envelope code is zero', () async {
+    final adapter = FakeHttpAdapter(
+      (_) async => FakeHttpResponse(envelope({'id': 7})),
+    );
+    final client = ApiClient(baseUrl: 'http://127.0.0.1:8081', adapter: adapter);
+
+    final data = await client.get('/app/dramas/7');
+    expect((data as Map)['id'], 7);
+  });
+
+  test('should throw an ApiException carrying the server message when the envelope code is not zero', () async {
+    final adapter = FakeHttpAdapter(
+      (_) async => FakeHttpResponse(
+        envelope(null, code: 40001, message: '邮箱格式不正确'),
+      ),
+    );
+    final client = ApiClient(baseUrl: 'http://127.0.0.1:8081', adapter: adapter);
+
+    await expectLater(
+      client.post('/app/auth/register', body: {'target': 'bad'}),
+      throwsA(
+        isA<ApiException>()
+            .having((e) => e.code, 'code', 40001)
+            .having((e) => e.message, 'message', '邮箱格式不正确'),
+      ),
+    );
+  });
+
+  test('should map a body without envelope to an ApiException carrying the http status', () async {
+    final adapter = FakeHttpAdapter((_) async => FakeHttpResponse('oops', 502));
+    final client = ApiClient(baseUrl: 'http://127.0.0.1:8081', adapter: adapter);
+
+    await expectLater(
+      client.get('/app/home/feed'),
+      throwsA(
+        isA<ApiException>().having((e) => e.code, 'code', 502),
+      ),
+    );
+  });
+
+  test('should send the bearer token and the device header when both are available', () async {
+    final adapter = FakeHttpAdapter((_) async => FakeHttpResponse(envelope(null)));
+    final client = ApiClient(
+      baseUrl: 'http://127.0.0.1:8081',
+      adapter: adapter,
+      accessTokenReader: () => 'token-1',
+      deviceIdReader: () async => 'device-9',
+    );
+
+    await client.get('/app/me');
+
+    final request = adapter.requests.single;
+    expect(request.headers['Authorization'], 'Bearer token-1');
+    expect(request.headers['X-Device-Id'], 'device-9');
+    expect(request.headers['Accept'], 'application/json');
+  });
+
+  test('should put the query map into the request uri', () async {
+    final adapter = FakeHttpAdapter((_) async => FakeHttpResponse(envelope(null)));
+    final client = ApiClient(baseUrl: 'http://127.0.0.1:8081', adapter: adapter);
+
+    await client.get('/app/search', query: {'keyword': '短剧', 'page': '2'});
+
+    final uri = adapter.requests.single.uri;
+    expect(uri.path, '/app/search');
+    expect(uri.queryParameters['keyword'], '短剧');
+    expect(uri.queryParameters['page'], '2');
+  });
+
+  test('should not refresh the token when the call opts out of auth retry', () async {
+    var refreshed = false;
+    final adapter = FakeHttpAdapter(
+      (_) async => FakeHttpResponse(envelope(null, code: 401, message: '登录已过期')),
+    );
+    final client = ApiClient(
+      baseUrl: 'http://127.0.0.1:8081',
+      adapter: adapter,
+      tokenRefresher: () async {
+        refreshed = true;
+        return true;
+      },
+    );
+
+    await expectLater(
+      client.post('/app/auth/refresh', body: {'refreshToken': 'r1'}, skipAuthRetry: true),
+      throwsA(isA<ApiException>().having((e) => e.code, 'code', 401)),
+    );
+    expect(refreshed, isFalse);
+    expect(adapter.requests, hasLength(1));
+  });
+}