feat: add Flutter mobile clients and staff delivery API

apps/user_app/lib/app/dependencies.dart

@@ -0,0 +1,83 @@
+import 'package:flutter/foundation.dart';
+
+import '../data/repositories/client_repository.dart';
+import '../data/services/api_client.dart';
+import '../data/services/secure_session_store.dart';
+
+class AppDependencies {
+  AppDependencies._({
+    required this.session,
+    required this.repository,
+  });
+
+  final UserSession session;
+  final ClientRepository repository;
+
+  static Future<AppDependencies> create() async {
+    final store = SecureSessionStore();
+    final session = UserSession(store);
+    await session.restore();
+    final api = ApiClient(() => session.token);
+    return AppDependencies._(session: session, repository: ClientRepository(api));
+  }
+}
+
+class UserSession extends ChangeNotifier {
+  UserSession(this._store);
+
+  static const _root = '/heqi/client/v1/user';
+  final SecureSessionStore _store;
+  String _token = '';
+
+  String get token => _token;
+  bool get isAuthenticated => _token.isNotEmpty;
+
+  Future<void> restore() async {
+    _token = await _store.readToken() ?? '';
+  }
+
+  Future<void> login({
+    required String phone,
+    required String password,
+    String? verificationCode,
+    String? requestIdentity,
+  }) async {
+    final api = ApiClient(() => '');
+    final verification = verificationCode != null && verificationCode.isNotEmpty;
+    final details = jsonMap(
+      await api.post(
+        '$_root/auth/login',
+        authenticated: false,
+        body: {
+          'phone': phone,
+          'mode': verification ? 'verification_code' : 'password',
+          'password': verification ? '' : password,
+          'code': verificationCode ?? '',
+          'request_identity': requestIdentity ?? '',
+        },
+      ),
+    );
+    _token = details['access_token'] as String? ?? '';
+    if (_token.isEmpty) throw const ApiException(500, '登录令牌缺失');
+    await _store.writeToken(_token);
+    notifyListeners();
+  }
+
+  Future<String> sendCode(String phone, String purpose) async {
+    final api = ApiClient(() => '');
+    final details = jsonMap(
+      await api.post(
+        '$_root/auth/verification-code',
+        authenticated: false,
+        body: {'phone': phone, 'purpose': purpose},
+      ),
+    );
+    return details['request_identity'] as String? ?? '';
+  }
+
+  Future<void> logout() async {
+    _token = '';
+    await _store.clear();
+    notifyListeners();
+  }
+}