已完成用户APP首期功能开发

交付用户端首期页面、配套接口、后台资源及测试文档。用户APP构建、静态分析和三个管理后台构建通过；完整测试仍有2项失败，后端模型注释检查未通过，详见交付记录。

apps/user_app/lib/app/dependencies.dart

@@ -6,15 +6,19 @@ import 'package:flutter/foundation.dart';
 import '../data/repositories/client_repository.dart';
 import '../data/services/api_client.dart';
 import '../data/services/secure_session_store.dart';
+import '../data/services/repair_draft_store.dart';
+import '../domain/models/primary_models.dart';
 
 class AppDependencies {
   AppDependencies({
     required this.session,
     required this.repository,
+    this.repairDraftStore,
   });
 
   final UserSession session;
   final ClientRepository repository;
+  final RepairDraftStore? repairDraftStore;
 
   static Future<AppDependencies> create() async {
     final store = SecureSessionStore();
@@ -24,7 +28,11 @@ class AppDependencies {
       () => session.token,
       onUnauthorized: session.invalidate,
     );
-    return AppDependencies(session: session, repository: ClientRepository(api));
+    return AppDependencies(
+      session: session,
+      repository: ClientRepository(api),
+      repairDraftStore: SecureRepairDraftStore(),
+    );
   }
 }
 
@@ -36,6 +44,13 @@ class UserSession extends ChangeNotifier {
   final SessionStore _store;
   String _token = '';
   bool _expired = false;
+
+  /// 本次登录是否持久化；默认兼容旧调用方，登录页由用户显式选择。
+  bool rememberLogin = true;
+
+  /// 只保存本次明确同意的内容版本，不在客户端推测当前发布版本。
+  List<PublishedContent> loginConsents = const [];
+  DateTime? loginConsentShownAt;
   Future<void> _pendingClear = Future<void>.value();
 
   String get token => _token;
@@ -66,6 +81,15 @@ class UserSession extends ChangeNotifier {
           'password': verification ? '' : password,
           'code': verificationCode ?? '',
           'request_identity': requestIdentity ?? '',
+          if (loginConsents.isNotEmpty)
+            'consents': [
+              for (final c in loginConsents)
+                {
+                  'identity': c.identity,
+                  'version': c.version,
+                  'shown_at': loginConsentShownAt?.toUtc().toIso8601String(),
+                },
+            ],
         },
       ),
     );
@@ -74,9 +98,16 @@ class UserSession extends ChangeNotifier {
 
     // 等待旧令牌清理结束，避免迟到的删除任务误删刚写入的新令牌。
     await _pendingClear;
-    await _store.writeToken(token);
+    if (rememberLogin) {
+      await _store.writeToken(token);
+    } else {
+      // 清理历史令牌失败时不能声称已关闭持久会话。
+      await _store.clear();
+    }
     _token = token;
     _expired = false;
+    loginConsents = const [];
+    loginConsentShownAt = null;
     notifyListeners();
   }
 
@@ -89,9 +120,32 @@ class UserSession extends ChangeNotifier {
         body: {'phone': phone, 'purpose': purpose},
       ),
     );
+    // Mock环境只生成服务端校验记录，并未向用户手机发送短信，不能启动已发送倒计时。
+    if (details['delivery_status'] == 'not_sent') {
+      throw const ApiException(2410, '短信验证码暂未开放');
+    }
     return details['request_identity'] as String? ?? '';
   }
 
+  /// 使用重置专用验证码修改密码，服务端校验验证码用途和密码规则。
+  Future<void> resetPassword({
+    required String phone,
+    required String code,
+    required String requestIdentity,
+    required String password,
+  }) async {
+    await ApiClient(() => '').post(
+      '$_root/auth/reset-password',
+      authenticated: false,
+      body: {
+        'phone': phone,
+        'code': code,
+        'request_identity': requestIdentity,
+        'new_password': password,
+      },
+    );
+  }
+
   Future<void> logout() async {
     _token = '';
     _expired = false;