feat: 文件存储安全加固 + 认证增强 + 媒体URL保护 + provider 重构

## 后端安全加固
- 新增 UserUploadPathResolver: 用户上传文件路径安全解析, 防目录穿越
- LocalReportFileStorage: 文件存储路径安全加固
- local_account_file_cleanup: 账号删除时文件清理逻辑增强
- AuthService: 认证逻辑增强
- file_endpoints / report_endpoints: 文件访问接口安全加固
- ai_chat_endpoints / doctor_endpoints: 接口安全调整
- Program.cs: 服务注册调整

## 前端认证与媒体
- 新增 authenticated_network_image.dart: 带认证的图片加载组件
- auth_provider: 认证状态管理大幅增强(+173)
- api_client: 网络客户端增强(+124)
- chat_provider: 聊天 provider 重构(+76)
- omron_device_provider: 蓝牙设备 provider 增强(+53)
- sse_handler: SSE 处理增强(+35)
- consultation_provider / data_providers / conversation_history_provider: 调整

## 页面调整
- remaining_pages: 健康档案/饮食记录等页面增强(+115)
- home_page / chat_messages_view: 主页微调
- doctor 端多页微调(consultations/dashboard/followups/patient_detail/profile/report_detail/reports)
- report_pages / settings_pages / notification_prefs_page: 微调
- device_scan_page / diet_capture_page / admin_home_page: 微调

## 测试
- 新增 file_path_security_tests: 文件路径安全测试
- 新增 protected_media_url_test: 媒体URL保护测试
- 新增 user_session_identity_test: 用户会话身份测试
- account_deletion_tests / application_service_tests / auth_tests: 更新

health_app/lib/pages/home/widgets/chat_messages_view.dart

@@ -6,12 +6,12 @@ import '../../../core/app_colors.dart';
 import '../../../core/app_design_tokens.dart';
 import '../../../core/app_module_visuals.dart';
 import '../../../core/app_theme.dart';
-import '../../../core/api_client.dart' show baseUrl;
 import '../../../core/navigation_provider.dart';
 import '../../../providers/chat_provider.dart';
 import '../../../providers/data_providers.dart';
 import '../../../widgets/ai_content.dart';
 import '../../../widgets/app_toast.dart';
+import '../../../widgets/authenticated_network_image.dart';
 
 ChatMessage messageAtDisplayIndex(List<ChatMessage> messages, int index) =>
     messages[index];
@@ -1045,8 +1045,8 @@ class ChatMessagesView extends ConsumerWidget {
                         child: localPath != null
                             ? Image.file(File(localPath), fit: BoxFit.cover)
                             : imageUrl != null
-                            ? Image.network(
-                                _mediaUrl(imageUrl),
+                            ? AuthenticatedNetworkImage(
+                                imageUrl: imageUrl,
                                 fit: BoxFit.cover,
                                 errorBuilder: (_, e, s) => Container(
                                   width: 80,
@@ -1122,7 +1122,11 @@ class ChatMessagesView extends ConsumerWidget {
 
   static void _showFullImage(BuildContext context, String? path) {
     if (path == null) return;
-    final resolvedPath = _mediaUrl(path);
+    final isNetwork =
+        path.startsWith('http://') ||
+        path.startsWith('https://') ||
+        path.startsWith('/uploads/') ||
+        path.startsWith('/api/');
     showDialog(
       context: context,
       builder: (ctx) => Dialog(
@@ -1134,9 +1138,12 @@ class ChatMessagesView extends ConsumerWidget {
             ClipRRect(
               borderRadius: BorderRadius.circular(12),
               child: InteractiveViewer(
-                child: resolvedPath.startsWith('http')
-                    ? Image.network(resolvedPath, fit: BoxFit.contain)
-                    : Image.file(File(resolvedPath), fit: BoxFit.contain),
+                child: isNetwork
+                    ? AuthenticatedNetworkImage(
+                        imageUrl: path,
+                        fit: BoxFit.contain,
+                      )
+                    : Image.file(File(path), fit: BoxFit.contain),
               ),
             ),
             Positioned(
@@ -1160,12 +1167,6 @@ class ChatMessagesView extends ConsumerWidget {
     );
   }
 
-  static String _mediaUrl(String path) {
-    if (path.startsWith('http://') || path.startsWith('https://')) return path;
-    if (path.startsWith('/uploads/')) return '$baseUrl$path';
-    return path;
-  }
-
   /// 处理 AI 回复里的 markdown 链接点击：
   /// - app://diet → 触发拍照/相册选择，跳到饮食拍照流程
   /// - app://report → 跳到报告列表（用户可在那里上传新报告）