feat: 文件存储安全加固 + 认证增强 + 媒体URL保护 + provider 重构

## 后端安全加固
- 新增 UserUploadPathResolver: 用户上传文件路径安全解析, 防目录穿越
- LocalReportFileStorage: 文件存储路径安全加固
- local_account_file_cleanup: 账号删除时文件清理逻辑增强
- AuthService: 认证逻辑增强
- file_endpoints / report_endpoints: 文件访问接口安全加固
- ai_chat_endpoints / doctor_endpoints: 接口安全调整
- Program.cs: 服务注册调整

## 前端认证与媒体
- 新增 authenticated_network_image.dart: 带认证的图片加载组件
- auth_provider: 认证状态管理大幅增强(+173)
- api_client: 网络客户端增强(+124)
- chat_provider: 聊天 provider 重构(+76)
- omron_device_provider: 蓝牙设备 provider 增强(+53)
- sse_handler: SSE 处理增强(+35)
- consultation_provider / data_providers / conversation_history_provider: 调整

## 页面调整
- remaining_pages: 健康档案/饮食记录等页面增强(+115)
- home_page / chat_messages_view: 主页微调
- doctor 端多页微调(consultations/dashboard/followups/patient_detail/profile/report_detail/reports)
- report_pages / settings_pages / notification_prefs_page: 微调
- device_scan_page / diet_capture_page / admin_home_page: 微调

## 测试
- 新增 file_path_security_tests: 文件路径安全测试
- 新增 protected_media_url_test: 媒体URL保护测试
- 新增 user_session_identity_test: 用户会话身份测试
- account_deletion_tests / application_service_tests / auth_tests: 更新

health_app/lib/pages/doctor/doctor_consultations_page.dart

@@ -9,6 +9,7 @@ import '../../widgets/backoffice_ui.dart';
 final _consListProvider = FutureProvider<List<Map<String, dynamic>>>((
   ref,
 ) async {
+  ref.watch(userSessionIdentityProvider);
   final api = ref.read(apiClientProvider);
   final res = await api.get('/api/doctor/consultations');
   return (res.data['data'] as List?)?.cast<Map<String, dynamic>>() ?? [];

health_app/lib/pages/doctor/doctor_dashboard_page.dart

@@ -7,6 +7,7 @@ import '../../widgets/backoffice_ui.dart';
 import '../doctor/doctor_home_page.dart' show doctorPageProvider;
 
 final _dashboardProvider = FutureProvider<Map<String, dynamic>?>((ref) async {
+  ref.watch(userSessionIdentityProvider);
   final api = ref.read(apiClientProvider);
   final res = await api.get('/api/doctor/dashboard');
   return res.data['data'] as Map<String, dynamic>?;

health_app/lib/pages/doctor/doctor_followup_edit_page.dart

@@ -9,6 +9,7 @@ import '../../widgets/app_toast.dart';
 import '../../widgets/backoffice_ui.dart';
 
 final _ptsSimple = FutureProvider<List<Map<String, dynamic>>>((ref) async {
+  ref.watch(userSessionIdentityProvider);
   final api = ref.read(apiClientProvider);
   final res = await api.get('/api/doctor/patients-simple');
   return (res.data['data'] as List?)?.cast<Map<String, dynamic>>() ?? [];
@@ -50,7 +51,9 @@ class _DoctorFollowUpEditPageState
           _titleCtrl.text = d['title'] ?? '';
           _notesCtrl.text = d['notes'] ?? '';
           _pid = d['userId']?.toString();
-          final at = DateTime.tryParse(d['scheduledAt']?.toString() ?? '');
+          final at = DateTime.tryParse(
+            d['scheduledAt']?.toString() ?? '',
+          )?.toLocal();
           if (at != null) {
             _date = at;
             _time = TimeOfDay.fromDateTime(at);
@@ -261,7 +264,7 @@ class _DoctorFollowUpEditPageState
       final data = {
         'userId': _pid,
         'title': _titleCtrl.text.trim(),
-        'scheduledAt': at.toIso8601String(),
+        'scheduledAt': at.toUtc().toIso8601String(),
         'notes': _notesCtrl.text.trim().isEmpty ? null : _notesCtrl.text.trim(),
       };
       if (isEdit) {
@@ -294,6 +297,7 @@ final _fupDetailForEdit = FutureProvider.family<Map<String, dynamic>?, String>((
   ref,
   id,
 ) async {
+  ref.watch(userSessionIdentityProvider);
   final api = ref.read(apiClientProvider);
   final res = await api.get('/api/doctor/follow-ups');
   final items = (res.data['data'] as List?)?.cast<Map<String, dynamic>>() ?? [];

health_app/lib/pages/doctor/doctor_followups_page.dart

@@ -8,6 +8,7 @@ import '../../utils/backoffice_formatters.dart';
 import '../../widgets/backoffice_ui.dart';
 
 final _fupRefresh = FutureProvider<String?>((ref) async {
+  ref.watch(userSessionIdentityProvider);
   final api = ref.read(apiClientProvider);
   final res = await api.get('/api/doctor/follow-ups');
   final items = (res.data['data'] as List?)?.cast<Map<String, dynamic>>() ?? [];
@@ -21,7 +22,11 @@ final _fupList = NotifierProvider<FupListN, List<Map<String, dynamic>>>(
 
 class FupListN extends Notifier<List<Map<String, dynamic>>> {
   @override
-  List<Map<String, dynamic>> build() => [];
+  List<Map<String, dynamic>> build() {
+    ref.watch(userSessionIdentityProvider);
+    return [];
+  }
+
   void replace(List<Map<String, dynamic>> v) => state = v;
   void markDone(String id) => state = state
       .map((f) => f['id'] == id ? {...f, 'status': 'Completed'} : f)

health_app/lib/pages/doctor/doctor_home_page.dart

@@ -1,6 +1,7 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import '../../core/app_colors.dart';
+import '../../providers/auth_provider.dart';
 import '../../widgets/doctor_drawer.dart';
 import '../../widgets/backoffice_ui.dart';
 import 'doctor_dashboard_page.dart';
@@ -97,6 +98,10 @@ final doctorPageProvider = NotifierProvider<DoctorPageNotifier, String>(
 
 class DoctorPageNotifier extends Notifier<String> {
   @override
-  String build() => 'dashboard';
+  String build() {
+    ref.watch(userSessionIdentityProvider);
+    return 'dashboard';
+  }
+
   void set(String page) => state = page;
 }

health_app/lib/pages/doctor/doctor_patient_detail_page.dart

@@ -8,6 +8,7 @@ import '../../widgets/backoffice_ui.dart';
 
 final _patientDetailProvider =
     FutureProvider.family<Map<String, dynamic>?, String>((ref, id) async {
+      ref.watch(userSessionIdentityProvider);
       final api = ref.read(apiClientProvider);
       final res = await api.get('/api/doctor/patients/$id');
       return res.data['data'] as Map<String, dynamic>?;

health_app/lib/pages/doctor/doctor_profile_page.dart

@@ -7,6 +7,7 @@ import '../../widgets/app_toast.dart';
 import '../../widgets/backoffice_ui.dart';
 
 final _docProfileProvider = FutureProvider<Map<String, dynamic>?>((ref) async {
+  ref.watch(userSessionIdentityProvider);
   final api = ref.read(apiClientProvider);
   final res = await api.get('/api/doctor/profile');
   return res.data['data'] as Map<String, dynamic>?;

health_app/lib/pages/doctor/doctor_report_detail_page.dart

@@ -10,6 +10,7 @@ import '../../widgets/backoffice_ui.dart';
 
 final _reportDetailProvider =
     FutureProvider.family<Map<String, dynamic>?, String>((ref, id) async {
+      ref.watch(userSessionIdentityProvider);
       final api = ref.read(apiClientProvider);
       final res = await api.get('/api/doctor/reports/$id');
       return res.data['data'] as Map<String, dynamic>?;

health_app/lib/pages/doctor/doctor_reports_page.dart

@@ -9,6 +9,7 @@ import '../../widgets/backoffice_ui.dart';
 final _reportsProvider = FutureProvider<List<Map<String, dynamic>>>((
   ref,
 ) async {
+  ref.watch(userSessionIdentityProvider);
   final api = ref.read(apiClientProvider);
   final res = await api.get('/api/doctor/reports');
   return (res.data['data'] as List?)?.cast<Map<String, dynamic>>() ?? [];