feat(client): C 端 1-2 账号链路（邮箱登录/注册 + 令牌与 401 + 匿名/登录分叉）

为什么：客户端此前完全没有账号概念（mine 页的"登录"只是本地 demo 开关），
而受限动作（收藏/评论）要对到具体账号。本批把账号链路接上，为后续互动、进度同步、下载打底。

- AuthApi + AuthController + AuthSessionStore：注册/登录/登出/刷新，令牌与设备号存 shared_preferences
  （用 SharedPreferencesAsync，与 engagement 仓库同一套 API）
- ApiClient：统一带 Authorization 与 X-Device-Id；401 自动刷新一次并重试，刷新失败清登录态走 onUnauthorized
- 登录/注册页（pages/auth，沿用 binding/logic/view 与现有视觉）：邮箱格式、密码 8-64 位含字母数字本地先校验，
  错误提示走 l10n；登录/注册一键切换
- 匿名/登录分叉：首页、发现、详情保持匿名可看；收藏/点赞等受限动作走 ensureSignedIn() 弹底部提示引导登录
- mine 页展示真实账号（昵称 + uid），拿不到才回落到演示文案
- 测试：新增 auth 控制器（注册落盘/401 刷新重试/刷新失败清会话/登出）与登录页（校验/切换）用例；
  widget_test 改为预置本地会话（账号不再是本地开关）；修掉 playback 用例对 host 大小写的环境依赖断言

门禁：flutter analyze 0 问题；flutter test 148 全过。

test/auth/auth_page_test.dart

@@ -0,0 +1,81 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:http/http.dart' as http;
+import 'package:http/testing.dart';
+import 'package:provider/provider.dart';
+import 'package:shared_preferences_platform_interface/in_memory_shared_preferences_async.dart';
+import 'package:shared_preferences_platform_interface/shared_preferences_async_platform_interface.dart';
+
+import 'package:nontonki/core/data/remote/auth_api.dart';
+import 'package:nontonki/core/data/remote/api_client.dart';
+import 'package:nontonki/core/data/services/auth_controller.dart';
+import 'package:nontonki/core/data/services/auth_session_store.dart';
+import 'package:nontonki/l10n/app_localizations.dart';
+import 'package:nontonki/pages/auth/auth_view.dart';
+
+/// 登录/注册页的可读证据：校验提示 + 登录/注册切换 + 未登录时不会去发请求。
+void main() {
+  setUp(() {
+    SharedPreferencesAsyncPlatform.instance =
+        InMemorySharedPreferencesAsync.empty();
+  });
+
+  Future<void> pumpAuthPage(WidgetTester tester, {bool signUp = false}) async {
+    final auth = AuthController(
+      AuthApi(
+        // 这个测试不联网：请求一律 500，正好用于验证"本地校验没过就不发请求"
+        ApiClient(
+          baseUrl: 'http://127.0.0.1:1',
+          client: MockClient((_) async => http.Response('{}', 500)),
+        ),
+      ),
+      AuthSessionStore(),
+    );
+    await tester.pumpWidget(
+      ChangeNotifierProvider<AuthController>.value(
+        value: auth,
+        child: MaterialApp(
+          locale: const Locale('en'),
+          localizationsDelegates: AppLocalizations.localizationsDelegates,
+          supportedLocales: AppLocalizations.supportedLocales,
+          home: AuthPage(signUpMode: signUp),
+        ),
+      ),
+    );
+    await tester.pumpAndSettle();
+  }
+
+  testWidgets('empty form shows the email error and stays on the page', (tester) async {
+    await pumpAuthPage(tester);
+
+    expect(find.text('Welcome back'), findsOneWidget);
+
+    await tester.tap(find.byType(FilledButton));
+    await tester.pumpAndSettle();
+
+    expect(find.text('Enter your email'), findsOneWidget);
+    expect(find.text('Welcome back'), findsOneWidget);
+  });
+
+  testWidgets('weak password is rejected locally', (tester) async {
+    await pumpAuthPage(tester);
+
+    await tester.enterText(find.byType(TextField).first, 'a@b.com');
+    await tester.enterText(find.byType(TextField).last, 'abcdefgh');
+    await tester.tap(find.byType(FilledButton));
+    await tester.pumpAndSettle();
+
+    expect(find.text('Password needs both letters and numbers'), findsOneWidget);
+  });
+
+  testWidgets('switch link flips between sign in and sign up', (tester) async {
+    await pumpAuthPage(tester);
+    expect(find.text('Welcome back'), findsOneWidget);
+
+    await tester.tap(find.text('New here? Create an account'));
+    await tester.pumpAndSettle();
+
+    expect(find.text('Create your account'), findsOneWidget);
+    expect(find.text('Already have an account? Sign in'), findsOneWidget);
+  });
+}