refactor: 移除前端 Mock API，新增共享组件，优化认证流程

- 删除 mock_api_client、mock_calendar_service、mock_history_service
- 新增 fixed_length_code_input、link_button、message_composer 共享组件
- 优化登录/注册/密码重置页面使用新组件
- 简化 injection.dart 移除 mock 分支
- 更新 env.dart 配置（BACKEND_URL 替换 API_URL）
- 后端 agentscope 工具和测试更新
- 重构 AGENTS.md 文档结构
- 新增 deploy/ 目录和 protocol 文档

backend/AGENTS.md

@@ -2,6 +2,13 @@
 
 This document defines Python/FastAPI backend development constraints.
 
+## Scope and Precedence
+
+- This file applies to all changes under `backend/**`.
+- It extends root routing rules in `AGENTS.md` and workspace global runtime rules.
+- If rules conflict, follow stricter requirements.
+- Keep backend-only rules here; do not duplicate them in root `AGENTS.md`.
+
 ## Python Environment
 
 **MUST use uv for dependency management and virtual environment execution.**
@@ -71,7 +78,7 @@ Do not bypass or weaken checks (no ignores, disables, or config relaxations). Re
 3. Implement minimal code (GREEN) - only to pass
 4. Run tests - confirm success
 5. Refactor (IMPROVE)
-6. Verify coverage - must be 80%+
+6. Verify coverage - target 80%+
 
 ### Enforcement
 
@@ -132,10 +139,13 @@ Before ANY commit:
 # NEVER: Hardcoded secrets
 api_key = "sk-proj-xxxxx"
 
-# ALWAYS: Environment variables
-api_key = os.environ.get("OPENAI_API_KEY")
+# ALWAYS: Read through centralized settings
+from core.config.settings import Settings
+
+settings = Settings()
+api_key = settings.openai_api_key
 if not api_key:
-    raise ValueError("OPENAI_API_KEY not configured")
+    raise ValueError("OPENAI_API_KEY not configured in settings")
 ```
 
 ## Database Development Rules
@@ -227,6 +237,11 @@ class AgentType(str, Enum):
 - [ ] Downgrade path is reversible and does not silently weaken intended production security
 - [ ] Any exemption is documented with clear non-exposure evidence
 
+## Backend Startup
+
+**Always use `./infra/scripts/app.sh` to start/stop the backend.** Do not start uvicorn directly.
+**Always use `./logs/*.log` to check the backend log output.**
+
 ## Agent Loop (AG-UI Protocol)
 
 Agent loop functionality MUST follow the AG-UI protocol. **Use the `ag-ui` skill** for protocol reference and implementation guidance.
@@ -235,8 +250,6 @@ Agent loop functionality MUST follow the AG-UI protocol. **Use the `ag-ui` skill
 
 Multi-agent orchestration MUST use the AgentScope framework. **Use the `agentscope-skill`** for framework reference and implementation guidance.
 
-For workflows involving routing, LiteLLM proxy cost audit, or frontend/backend human approval loops, **use the `agentscope-hitl-cost` skill**.
-
 ### Core Principles
 
 - Use AgentScope for orchestrating multiple agents working together