feat: 实现 Auth 全局状态机与 401 统一处理机制

- 新增 AuthSessionInvalidated 事件处理 token 失效场景
- ApiInterceptor 新增 authFailureCallback 单飞机制
- AuthBloc 区分 manual logout 与 auto expiry 语义
- 新增 startup recovery fallback 防止启动卡死

feat: 重构 Calendar DayWeek 视图事件布局引擎

- 新增 DayEventLayoutEngine 解耦事件计算与渲染
- 新增 DayTimelineMetrics 统一时间轴常量
- 新增 DayViewScale 支持捏合缩放

feat: 新增 Settings 页面共享 UI 组件

- 新增 BackTitlePageHeader 统一页面 header
- 新增 DetailHeaderActionMenu 统一操作菜单
- 新增 DestructiveActionSheet 统一删除确认
- 新增 AppToggleSwitch 统一开关组件

feat: Chat UI Schema 支持导航操作

- 支持 navigation 类型 action 触发内部路由跳转
- 新增路径验证与参数处理

chore: 更新相关测试覆盖 auth 失效路径

apps/lib/core/api/api_client.dart

@@ -15,7 +15,16 @@ class ApiClient implements IApiClient {
     required TokenStorage tokenStorage,
     Dio? dio,
   }) {
-    final effectiveDio = dio ?? Dio(BaseOptions(baseUrl: baseUrl));
+    final effectiveDio =
+        dio ??
+        Dio(
+          BaseOptions(
+            baseUrl: baseUrl,
+            connectTimeout: const Duration(seconds: 10),
+            receiveTimeout: const Duration(seconds: 20),
+            sendTimeout: const Duration(seconds: 20),
+          ),
+        );
     final interceptor = ApiInterceptor(
       tokenStorage: tokenStorage,
       dio: effectiveDio,
@@ -50,6 +59,11 @@ class ApiClient implements IApiClient {
     };
   }
 
+  void setAuthFailureCallback(Future<void> Function() onAuthFailure) {
+    _interceptor.onAuthFailure = onAuthFailure;
+  }
+
+  @override
   Future<Response<T>> get<T>(String path, {Options? options}) async {
     try {
       return await _dio.get<T>(path, options: options);

apps/lib/core/api/api_interceptor.dart

@@ -6,7 +6,9 @@ class ApiInterceptor extends Interceptor {
   final Dio dio;
   final Duration refreshFailureCooldown;
   Future<bool> Function()? onTokenRefresh;
+  Future<void> Function()? onAuthFailure;
   Future<bool>? _refreshFuture;
+  Future<void>? _authFailureFuture;
   DateTime? _refreshBlockedUntil;
 
   static const _retriedRequestKey = '_auth_retry_once';
@@ -34,6 +36,10 @@ class ApiInterceptor extends Interceptor {
   @override
   void onError(DioException err, ErrorInterceptorHandler handler) async {
     final requestOptions = err.requestOptions;
+    final isUnauthorized = err.response?.statusCode == 401;
+    final shouldHandleUnauthorized =
+        isUnauthorized && _isAuthenticatedRequest(requestOptions);
+
     if (err.response?.statusCode == 401 &&
         onTokenRefresh != null &&
         !_shouldSkipRefresh(requestOptions)) {
@@ -57,11 +63,36 @@ class ApiInterceptor extends Interceptor {
             // Retry failed, proceed with original error.
           }
         }
+      } else if (shouldHandleUnauthorized) {
+        await _notifyAuthFailureSingleflight();
       }
+    } else if (shouldHandleUnauthorized && _shouldSkipRefresh(requestOptions)) {
+      await _notifyAuthFailureSingleflight();
     }
     handler.next(err);
   }
 
+  bool _isAuthenticatedRequest(RequestOptions options) {
+    return options.headers['Authorization'] != null;
+  }
+
+  Future<void> _notifyAuthFailureSingleflight() {
+    final existing = _authFailureFuture;
+    if (existing != null) {
+      return existing;
+    }
+    final callback = onAuthFailure;
+    if (callback == null) {
+      return Future<void>.value();
+    }
+
+    final future = callback().whenComplete(() {
+      _authFailureFuture = null;
+    });
+    _authFailureFuture = future;
+    return future;
+  }
+
   bool _shouldSkipRefresh(RequestOptions options) {
     final blockedUntil = _refreshBlockedUntil;
     if (blockedUntil != null && DateTime.now().isBefore(blockedUntil)) {
@@ -101,6 +132,7 @@ class ApiInterceptor extends Interceptor {
 
   void reset() {
     _refreshFuture = null;
+    _authFailureFuture = null;
     _refreshBlockedUntil = null;
   }
 }