feat: A1 网络层与鉴权 + A2 账号登录对接

- 引入 dio，封装统一 ApiClient（BaseUrl/Token 注入/401 自动刷新/{code,message,data} 解包）
- TokenStorage 令牌持久化，AuthController 登录状态管理
- AuthRepository 封装 otp/login/logout 接口
- 登录页对接手机号/邮箱验证码登录（Google 登录待 OAuth client 配置）

lib/app.dart

@@ -4,11 +4,15 @@ import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
 
 import 'core/config/locale_controller.dart';
+import 'core/data/repositories/auth_repository.dart';
 import 'core/data/repositories/catalog_repository.dart';
 import 'core/data/repositories/engagement_repository.dart';
+import 'core/data/services/api_client.dart';
+import 'core/data/services/auth_controller.dart';
 import 'core/data/services/catalog_controller.dart';
 import 'core/data/services/engagement_controller.dart';
 import 'core/data/services/playback_session.dart';
+import 'core/data/services/token_storage.dart';
 import 'core/data/services/video_player_port.dart';
 import 'l10n/app_localizations.dart';
 import 'pages/login/login_view.dart';
@@ -24,6 +28,17 @@ class LumaDramaApp extends StatelessWidget {
       providers: [
         Provider(create: (_) => PlaybackCoordinator()),
         Provider<PlayerFactory>(create: (_) => playerFactory),
+        Provider(create: (_) => ApiClient()),
+        Provider(create: (_) => TokenStorage()),
+        Provider(
+          create: (ctx) => AuthRepository(
+            ctx.read<ApiClient>(),
+            ctx.read<TokenStorage>(),
+          ),
+        ),
+        ChangeNotifierProvider(
+          create: (ctx) => AuthController(ctx.read<AuthRepository>()),
+        ),
         ChangeNotifierProvider(
           create: (_) => CatalogController(DemoCatalogRepository())..load(),
         ),

lib/core/config/api_config.dart

@@ -0,0 +1,15 @@
+// Author: fruit.com.cn
+
+/// 接口地址与超时配置。
+class ApiConfig {
+  ApiConfig._();
+
+  /// 客户端 app-api 地址，可用 --dart-define=API_BASE_URL=... 覆盖。
+  static const String baseUrl = String.fromEnvironment(
+    'API_BASE_URL',
+    defaultValue: 'http://127.0.0.1:8081',
+  );
+
+  static const int connectTimeoutSeconds = 10;
+  static const int receiveTimeoutSeconds = 15;
+}

lib/core/data/repositories/auth_repository.dart

@@ -0,0 +1,91 @@
+// Author: fruit.com.cn
+
+import 'api_client.dart';
+import 'token_storage.dart';
+
+/// 登录/刷新成功后返回的会话令牌。
+class AuthSession {
+  AuthSession({
+    required this.accessToken,
+    required this.refreshToken,
+    required this.expiresIn,
+    required this.newUser,
+  });
+
+  final String accessToken;
+  final String refreshToken;
+  final int expiresIn;
+  final bool newUser;
+
+  factory AuthSession.fromJson(Map<String, dynamic> json) {
+    return AuthSession(
+      accessToken: json['accessToken'] as String,
+      refreshToken: json['refreshToken'] as String,
+      expiresIn: (json['expiresIn'] as num?)?.toInt() ?? 7200,
+      newUser: json['newUser'] as bool? ?? false,
+    );
+  }
+}
+
+/// 账号与鉴权接口封装。
+class AuthRepository {
+  AuthRepository(this._client, this._tokenStorage);
+
+  final ApiClient _client;
+  final TokenStorage _tokenStorage;
+
+  /// 发送验证码。
+  Future<void> sendOtp({
+    required String scene,
+    required String targetType,
+    required String target,
+  }) async {
+    await _client.post('/app/auth/otp', data: {
+      'scene': scene,
+      'targetType': targetType,
+      'target': target,
+    });
+  }
+
+  /// 验证码登录。
+  Future<AuthSession> loginWithCode({
+    required String targetType,
+    required String target,
+    required String code,
+  }) async {
+    final data = await _client.post('/app/auth/login', data: {
+      'targetType': targetType,
+      'target': target,
+      'code': code,
+    });
+    return AuthSession.fromJson(data as Map<String, dynamic>);
+  }
+
+  /// 密码登录。
+  Future<AuthSession> loginWithPassword({
+    required String targetType,
+    required String target,
+    required String password,
+  }) async {
+    final data = await _client.post('/app/auth/login', data: {
+      'targetType': targetType,
+      'target': target,
+      'password': password,
+    });
+    return AuthSession.fromJson(data as Map<String, dynamic>);
+  }
+
+  /// 保存会话令牌。
+  Future<void> saveSession(AuthSession session) async {
+    await _tokenStorage.saveTokens(
+      access: session.accessToken,
+      refresh: session.refreshToken,
+    );
+  }
+
+  /// 登出并清理本地令牌。
+  Future<void> logout() async {
+    await _client.post('/app/auth/logout');
+    await _tokenStorage.clear();
+  }
+}

lib/core/data/services/api_client.dart

@@ -0,0 +1,136 @@
+// Author: fruit.com.cn
+
+import 'package:dio/dio.dart';
+
+import '../../config/api_config.dart';
+import 'token_storage.dart';
+
+/// 统一业务异常：code 为后端业务码，message 可直接展示。
+class ApiException implements Exception {
+  ApiException(this.code, this.message);
+
+  final int code;
+  final String message;
+
+  @override
+  String toString() => 'ApiException($code): $message';
+}
+
+/// 统一 HTTP 客户端：BaseUrl、Token 注入、401 自动刷新、{code,message,data} 解包。
+class ApiClient {
+  ApiClient({Dio? dio, TokenStorage? tokenStorage})
+    : _dio = dio ?? Dio(),
+      _tokenStorage = tokenStorage ?? TokenStorage() {
+    _dio.options
+      ..baseUrl = ApiConfig.baseUrl
+      ..connectTimeout = const Duration(
+        seconds: ApiConfig.connectTimeoutSeconds,
+      )
+      ..receiveTimeout = const Duration(
+        seconds: ApiConfig.receiveTimeoutSeconds,
+      );
+    _dio.interceptors.add(
+      InterceptorsWrapper(onRequest: _onRequest, onError: _onError),
+    );
+  }
+
+  final Dio _dio;
+  final TokenStorage _tokenStorage;
+
+  bool _refreshing = false;
+
+  Future<void> _onRequest(
+    RequestOptions options,
+    RequestInterceptorHandler handler,
+  ) async {
+    final access = await _tokenStorage.readAccessToken();
+    if (access != null && access.isNotEmpty) {
+      options.headers['Authorization'] = 'Bearer $access';
+    }
+    // 设备标识：第一阶段固定占位，A2 接入真实 deviceId。
+    options.headers['X-Device-Id'] = 'device-0001';
+    handler.next(options);
+  }
+
+  Future<void> _onError(
+    DioException error,
+    ErrorInterceptorHandler handler,
+  ) async {
+    final status = error.response?.statusCode;
+    final path = error.requestOptions.path;
+    final isAuthEndpoint =
+        path.endsWith('/auth/refresh') || path.endsWith('/auth/login');
+    if (status == 401 && !isAuthEndpoint && !_refreshing) {
+      final refreshed = await _refresh();
+      if (refreshed) {
+        handler.resolve(await _retry(error.requestOptions));
+        return;
+      }
+    }
+    handler.next(error);
+  }
+
+  Future<bool> _refresh() async {
+    _refreshing = true;
+    try {
+      final refresh = await _tokenStorage.readRefreshToken();
+      if (refresh == null || refresh.isEmpty) return false;
+      final response = await _dio.post<dynamic>(
+        '/app/auth/refresh',
+        data: {'refreshToken': refresh},
+      );
+      final body = response.data;
+      if (body is Map && body['code'] == 0) {
+        final data = body['data'] as Map;
+        await _tokenStorage.saveTokens(
+          access: data['accessToken'] as String,
+          refresh: data['refreshToken'] as String,
+        );
+        return true;
+      }
+      return false;
+    } catch (_) {
+      return false;
+    } finally {
+      _refreshing = false;
+    }
+  }
+
+  Future<Response<dynamic>> _retry(RequestOptions options) {
+    return _dio.fetch<dynamic>(options);
+  }
+
+  Future<dynamic> get(String path, {Map<String, dynamic>? query}) {
+    return _request(() => _dio.get<dynamic>(path, queryParameters: query));
+  }
+
+  Future<dynamic> post(String path, {Object? data}) {
+    return _request(() => _dio.post<dynamic>(path, data: data));
+  }
+
+  Future<dynamic> put(String path, {Object? data}) {
+    return _request(() => _dio.put<dynamic>(path, data: data));
+  }
+
+  Future<dynamic> delete(String path, {Object? data}) {
+    return _request(() => _dio.delete<dynamic>(path, data: data));
+  }
+
+  Future<dynamic> _request(Future<Response<dynamic>> Function() send) async {
+    try {
+      final response = await send();
+      final body = response.data;
+      if (body is Map && body.containsKey('code')) {
+        final code = body['code'];
+        if (code == 0) return body['data'];
+        throw ApiException(code as int, (body['message'] as String?) ?? '');
+      }
+      return body;
+    } on DioException catch (e) {
+      throw ApiException(
+        e.response?.statusCode ?? -1,
+        e.message ?? 'network error',
+      );
+    }
+  }
+}

lib/core/data/services/auth_controller.dart

@@ -0,0 +1,65 @@
+// Author: fruit.com.cn
+
+import 'package:flutter/foundation.dart';
+
+import '../repositories/auth_repository.dart';
+
+enum AuthStatus { unknown, authenticated, unauthenticated }
+
+/// 登录状态与账号操作。
+class AuthController extends ChangeNotifier {
+  AuthController(this._repository);
+
+  final AuthRepository _repository;
+
+  AuthStatus _status = AuthStatus.unknown;
+  AuthStatus get status => _status;
+
+  Future<void> sendOtp({
+    required String scene,
+    required String targetType,
+    required String target,
+  }) {
+    return _repository.sendOtp(
+      scene: scene,
+      targetType: targetType,
+      target: target,
+    );
+  }
+
+  Future<void> loginWithCode({
+    required String targetType,
+    required String target,
+    required String code,
+  }) async {
+    final session = await _repository.loginWithCode(
+      targetType: targetType,
+      target: target,
+      code: code,
+    );
+    await _repository.saveSession(session);
+    _status = AuthStatus.authenticated;
+    notifyListeners();
+  }
+
+  Future<void> loginWithPassword({
+    required String targetType,
+    required String target,
+    required String password,
+  }) async {
+    final session = await _repository.loginWithPassword(
+      targetType: targetType,
+      target: target,
+      password: password,
+    );
+    await _repository.saveSession(session);
+    _status = AuthStatus.authenticated;
+    notifyListeners();
+  }
+
+  Future<void> logout() async {
+    await _repository.logout();
+    _status = AuthStatus.unauthenticated;
+    notifyListeners();
+  }
+}

lib/core/data/services/token_storage.dart

@@ -0,0 +1,34 @@
+// Author: fruit.com.cn
+
+import 'package:shared_preferences/shared_preferences.dart';
+
+/// 令牌本地存储。第一阶段用 shared_preferences，后续可换 secure storage。
+class TokenStorage {
+  static const _accessKey = 'auth_access_token';
+  static const _refreshKey = 'auth_refresh_token';
+
+  Future<void> saveTokens({
+    required String access,
+    required String refresh,
+  }) async {
+    final prefs = await SharedPreferences.getInstance();
+    await prefs.setString(_accessKey, access);
+    await prefs.setString(_refreshKey, refresh);
+  }
+
+  Future<String?> readAccessToken() async {
+    final prefs = await SharedPreferences.getInstance();
+    return prefs.getString(_accessKey);
+  }
+
+  Future<String?> readRefreshToken() async {
+    final prefs = await SharedPreferences.getInstance();
+    return prefs.getString(_refreshKey);
+  }
+
+  Future<void> clear() async {
+    final prefs = await SharedPreferences.getInstance();
+    await prefs.remove(_accessKey);
+    await prefs.remove(_refreshKey);
+  }
+}

lib/pages/login/login_view.dart

@@ -1,11 +1,12 @@
 // Author: fruit.com.cn
 
 import 'package:flutter/material.dart';
+import 'package:provider/provider.dart';
 
+import '../../core/data/services/auth_controller.dart';
 import '../home/home_view.dart';
 
 /// 登录页：Google / 手机号 / 邮箱 三种登录入口 + 游客浏览。
-/// 当前为 UI 占位实现，真实登录逻辑在接入后端 /app/auth/** 后补充。
 class LoginPage extends StatefulWidget {
   const LoginPage({super.key});
 
@@ -23,6 +24,132 @@ class _LoginPageState extends State<LoginPage> {
     );
   }
 
+  Future<void> _showLoginSheet(String targetType) async {
+    final auth = context.read<AuthController>();
+    final targetCtrl = TextEditingController();
+    final codeCtrl = TextEditingController();
+    final isPhone = targetType == 'PHONE';
+
+    await showModalBottomSheet<void>(
+      context: context,
+      isScrollControlled: true,
+      backgroundColor: const Color(0xFF161822),
+      builder: (sheetContext) => Padding(
+        padding: EdgeInsets.only(
+          bottom: MediaQuery.of(sheetContext).viewInsets.bottom,
+        ),
+        child: Padding(
+          padding: const EdgeInsets.all(24),
+          child: Column(
+            mainAxisSize: MainAxisSize.min,
+            crossAxisAlignment: CrossAxisAlignment.stretch,
+            children: [
+              Text(
+                isPhone ? 'Phone Login' : 'Email Login',
+                style: const TextStyle(
+                  fontSize: 18,
+                  fontWeight: FontWeight.w700,
+                  color: Colors.white,
+                ),
+              ),
+              const SizedBox(height: 16),
+              TextField(
+                controller: targetCtrl,
+                keyboardType: isPhone
+                    ? TextInputType.phone
+                    : TextInputType.emailAddress,
+                style: const TextStyle(color: Colors.white),
+                decoration: InputDecoration(
+                  hintText: isPhone ? 'Phone number' : 'Email',
+                  hintStyle: const TextStyle(color: Colors.white38),
+                  filled: true,
+                  fillColor: Colors.white.withValues(alpha: 0.05),
+                  border: OutlineInputBorder(
+                    borderRadius: BorderRadius.circular(12),
+                    borderSide: BorderSide.none,
+                  ),
+                ),
+              ),
+              const SizedBox(height: 12),
+              Row(
+                children: [
+                  Expanded(
+                    child: TextField(
+                      controller: codeCtrl,
+                      keyboardType: TextInputType.number,
+                      style: const TextStyle(color: Colors.white),
+                      decoration: InputDecoration(
+                        hintText: 'Code',
+                        hintStyle: const TextStyle(color: Colors.white38),
+                        filled: true,
+                        fillColor: Colors.white.withValues(alpha: 0.05),
+                        border: OutlineInputBorder(
+                          borderRadius: BorderRadius.circular(12),
+                          borderSide: BorderSide.none,
+                        ),
+                      ),
+                    ),
+                  ),
+                  const SizedBox(width: 12),
+                  TextButton(
+                    onPressed: () async {
+                      try {
+                        await auth.sendOtp(
+                          scene: 'LOGIN',
+                          targetType: targetType,
+                          target: targetCtrl.text.trim(),
+                        );
+                        if (sheetContext.mounted) {
+                          ScaffoldMessenger.of(sheetContext).showSnackBar(
+                            const SnackBar(content: Text('Code sent')),
+                          );
+                        }
+                      } catch (e) {
+                        if (sheetContext.mounted) {
+                          ScaffoldMessenger.of(sheetContext).showSnackBar(
+                            SnackBar(content: Text('$e')),
+                          );
+                        }
+                      }
+                    },
+                    child: const Text('Send Code'),
+                  ),
+                ],
+              ),
+              const SizedBox(height: 20),
+              FilledButton(
+                onPressed: () async {
+                  try {
+                    await auth.loginWithCode(
+                      targetType: targetType,
+                      target: targetCtrl.text.trim(),
+                      code: codeCtrl.text.trim(),
+                    );
+                    if (sheetContext.mounted) {
+                      Navigator.of(sheetContext).pop();
+                    }
+                    _enterHome();
+                  } catch (e) {
+                    if (sheetContext.mounted) {
+                      ScaffoldMessenger.of(sheetContext).showSnackBar(
+                        SnackBar(content: Text('$e')),
+                      );
+                    }
+                  }
+                },
+                style: FilledButton.styleFrom(
+                  backgroundColor: _orange,
+                  padding: const EdgeInsets.symmetric(vertical: 14),
+                ),
+                child: const Text('Sign In'),
+              ),
+            ],
+          ),
+        ),
+      ),
+    );
+  }
+
   @override
   Widget build(BuildContext context) {
     return Scaffold(
@@ -86,14 +213,14 @@ class _LoginPageState extends State<LoginPage> {
                         icon: Icons.phone_iphone,
                         iconColor: _orange,
                         label: 'Continue with Phone Number',
-                        onTap: _enterHome,
+                        onTap: () => _showLoginSheet('PHONE'),
                       ),
                       const SizedBox(height: 14),
                       _DarkButton(
                         icon: Icons.email_outlined,
                         iconColor: _purple,
                         label: 'Continue with Email',
-                        onTap: _enterHome,
+                        onTap: () => _showLoginSheet('EMAIL'),
                       ),
                       const SizedBox(height: 32),
                       const _BonusPill(),