feat: 文件存储安全加固 + 认证增强 + 媒体URL保护 + provider 重构

## 后端安全加固
- 新增 UserUploadPathResolver: 用户上传文件路径安全解析, 防目录穿越
- LocalReportFileStorage: 文件存储路径安全加固
- local_account_file_cleanup: 账号删除时文件清理逻辑增强
- AuthService: 认证逻辑增强
- file_endpoints / report_endpoints: 文件访问接口安全加固
- ai_chat_endpoints / doctor_endpoints: 接口安全调整
- Program.cs: 服务注册调整

## 前端认证与媒体
- 新增 authenticated_network_image.dart: 带认证的图片加载组件
- auth_provider: 认证状态管理大幅增强(+173)
- api_client: 网络客户端增强(+124)
- chat_provider: 聊天 provider 重构(+76)
- omron_device_provider: 蓝牙设备 provider 增强(+53)
- sse_handler: SSE 处理增强(+35)
- consultation_provider / data_providers / conversation_history_provider: 调整

## 页面调整
- remaining_pages: 健康档案/饮食记录等页面增强(+115)
- home_page / chat_messages_view: 主页微调
- doctor 端多页微调(consultations/dashboard/followups/patient_detail/profile/report_detail/reports)
- report_pages / settings_pages / notification_prefs_page: 微调
- device_scan_page / diet_capture_page / admin_home_page: 微调

## 测试
- 新增 file_path_security_tests: 文件路径安全测试
- 新增 protected_media_url_test: 媒体URL保护测试
- 新增 user_session_identity_test: 用户会话身份测试
- account_deletion_tests / application_service_tests / auth_tests: 更新

backend/tests/Health.Tests/auth_tests.cs

@@ -1,4 +1,6 @@
+using System.Text.Json;
 using Health.Domain.Entities;
+using Health.Infrastructure.Auth;
 using Health.Infrastructure.Data;
 using Health.Infrastructure.Services;
 using Microsoft.EntityFrameworkCore;
@@ -118,6 +120,47 @@ public class AuthTests
         Assert.NotNull(active);
     }
 
+    [Fact]
+    public async Task Refresh_Should_Return_Stable_User_Identity()
+    {
+        using var db = CreateDbContext();
+        var config = CreateConfig();
+        var jwt = new JwtProvider(config);
+        var user = new User
+        {
+            Id = Guid.NewGuid(),
+            Phone = "13800138000",
+            Role = "User",
+            Name = "测试用户",
+            CreatedAt = DateTime.UtcNow,
+            UpdatedAt = DateTime.UtcNow
+        };
+        var oldRefresh = jwt.GenerateRefreshToken();
+        db.Users.Add(user);
+        db.RefreshTokens.Add(new RefreshToken
+        {
+            Id = Guid.NewGuid(),
+            UserId = user.Id,
+            Token = oldRefresh,
+            ExpiresAt = DateTime.UtcNow.AddDays(30)
+        });
+        await db.SaveChangesAsync();
+        var service = new AuthService(
+            db,
+            jwt,
+            new SmsService(),
+            new AppleTokenValidator(config));
+
+        var result = await service.RefreshAsync(oldRefresh, CancellationToken.None);
+
+        Assert.Equal(0, result.Code);
+        var data = JsonSerializer.SerializeToElement(result.Data);
+        var refreshedUser = data.GetProperty("user");
+        Assert.Equal(user.Id, refreshedUser.GetProperty("Id").GetGuid());
+        Assert.Equal(user.Phone, refreshedUser.GetProperty("Phone").GetString());
+        Assert.Equal(user.Role, refreshedUser.GetProperty("Role").GetString());
+    }
+
     [Fact]
     public async Task VerificationCode_Expired_Should_Fail_Login()
     {