chore: 优化本地开发环境配置

- 添加 .env.local 支持，app.sh 和 dev-migrate.sh 自动覆盖
- Docker Compose 使用 profiles 区分 dev/prod 环境
- 改进认证 dev session 判断逻辑，使用 test account 配置
- 修复 CoinPackageCard 重复代码问题
- 清理 opencode 配置，移除敏感信息
- 新增 infra/docker/README.md 文档
- 修复 ruff/pyright/flutter lint 错误
- 更新测试用例移除已删除的 country 字段

backend/tests/unit/test_auth_gateway_dev_session.py

@@ -10,7 +10,7 @@ from v1.auth.schemas import AuthUser, EmailSessionCreateRequest, SessionResponse
 
 
 @pytest.mark.asyncio
-async def test_create_email_session_uses_dev_bypass(
+async def test_create_email_session_uses_test_account_bypass(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
     gateway = SupabaseAuthGateway()
@@ -28,7 +28,8 @@ async def test_create_email_session_uses_dev_bypass(
         calls.update(kwargs)
         return expected
 
-    monkeypatch.setattr(gateway_module.config.runtime, "environment", "dev")
+    monkeypatch.setattr(gateway_module.config.test, "email", "test@example.com")
+    monkeypatch.setattr(gateway_module.config.test, "code", "123456")
     monkeypatch.setattr(
         gateway_module, "create_dev_email_session", _fake_create_dev_email_session
     )
@@ -47,7 +48,7 @@ async def test_create_email_session_uses_dev_bypass(
 
 
 @pytest.mark.asyncio
-async def test_create_email_session_uses_verify_otp_in_non_dev(
+async def test_create_email_session_uses_verify_otp_when_test_account_not_configured(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
     gateway = SupabaseAuthGateway()
@@ -66,7 +67,8 @@ async def test_create_email_session_uses_verify_otp_in_non_dev(
             user=SimpleNamespace(id="user-2", email="test@example.com"),
         )
 
-    monkeypatch.setattr(gateway_module.config.runtime, "environment", "prod")
+    monkeypatch.setattr(gateway_module.config.test, "email", "")
+    monkeypatch.setattr(gateway_module.config.test, "code", "")
     monkeypatch.setattr(
         gateway,
         "_get_client",
@@ -81,3 +83,79 @@ async def test_create_email_session_uses_verify_otp_in_non_dev(
         "token": "123456",
     }
     assert response.user.email == "test@example.com"
+
+
+@pytest.mark.asyncio
+async def test_create_email_session_uses_verify_otp_when_email_mismatch(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    gateway = SupabaseAuthGateway()
+    request = EmailSessionCreateRequest(email="other@example.com", token="123456")
+    captured_payload: dict[str, str] = {}
+
+    def _verify_otp(payload: dict[str, str]) -> SimpleNamespace:
+        captured_payload.update(payload)
+        return SimpleNamespace(
+            session=SimpleNamespace(
+                access_token="access",
+                refresh_token="refresh",
+                expires_in=3600,
+                token_type="bearer",
+            ),
+            user=SimpleNamespace(id="user-3", email="other@example.com"),
+        )
+
+    monkeypatch.setattr(gateway_module.config.test, "email", "test@example.com")
+    monkeypatch.setattr(gateway_module.config.test, "code", "123456")
+    monkeypatch.setattr(
+        gateway,
+        "_get_client",
+        lambda: SimpleNamespace(auth=SimpleNamespace(verify_otp=_verify_otp)),
+    )
+
+    response = await gateway.create_email_session(request)
+
+    assert captured_payload == {
+        "type": "email",
+        "email": "other@example.com",
+        "token": "123456",
+    }
+    assert response.user.email == "other@example.com"
+
+
+@pytest.mark.asyncio
+async def test_create_email_session_uses_verify_otp_when_code_mismatch(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    gateway = SupabaseAuthGateway()
+    request = EmailSessionCreateRequest(email="test@example.com", token="654321")
+    captured_payload: dict[str, str] = {}
+
+    def _verify_otp(payload: dict[str, str]) -> SimpleNamespace:
+        captured_payload.update(payload)
+        return SimpleNamespace(
+            session=SimpleNamespace(
+                access_token="access",
+                refresh_token="refresh",
+                expires_in=3600,
+                token_type="bearer",
+            ),
+            user=SimpleNamespace(id="user-4", email="test@example.com"),
+        )
+
+    monkeypatch.setattr(gateway_module.config.test, "email", "test@example.com")
+    monkeypatch.setattr(gateway_module.config.test, "code", "123456")
+    monkeypatch.setattr(
+        gateway,
+        "_get_client",
+        lambda: SimpleNamespace(auth=SimpleNamespace(verify_otp=_verify_otp)),
+    )
+
+    response = await gateway.create_email_session(request)
+
+    assert captured_payload == {
+        "type": "email",
+        "email": "test@example.com",
+        "token": "654321",
+    }
+    assert response.user.email == "test@example.com"