fix：对齐金值，主要注销，一键登录等方面修改

lib/features/web/presentation/mall_web_host.dart

@@ -571,13 +571,13 @@ class _MallWebHostState extends ConsumerState<MallWebHost>
     final mallAuth = logged ? await _issueMallAuthToken() : null;
     if (!mounted) return;
     final arguments = buildEnterWebMallBridgeArguments(
+      config: ref.read(mallTabConfigProvider),
       currentUri: uri!,
       logged: logged,
       isDark: Theme.of(context).brightness == Brightness.dark,
       authToken: mallAuth?.authToken,
       scene: mallAuth?.scene,
       sourceApp: mallAuth?.sourceApp,
-      attribution: ref.read(mallClickAttributionProvider),
     );
     _callH5Handler(JsEvent('enterWebMall', [arguments]));
   }

lib/features/web/presentation/web_page.dart

@@ -1,8 +1,11 @@
 import 'package:flutter/material.dart';
+import 'package:flutter/foundation.dart';
 import 'package:go_router/go_router.dart';
 import 'package:url_launcher/url_launcher.dart';
 import 'package:webview_flutter/webview_flutter.dart';
 
+import '../application/web_navigation_policy.dart';
+
 /// Shared HTTPS WebView host. Mall-specific residency and attribution are
 /// layered above this page so ordinary H5 links never receive mall state.
 class AppWebPage extends StatefulWidget {
@@ -10,12 +13,10 @@ class AppWebPage extends StatefulWidget {
     super.key,
     required this.initialUri,
     this.hideTitle = false,
-    this.allowedHosts = const <String>{},
   });
 
   final Uri initialUri;
   final bool hideTitle;
-  final Set<String> allowedHosts;
 
   @override
   State<AppWebPage> createState() => _AppWebPageState();
@@ -60,23 +61,19 @@ class _AppWebPageState extends State<AppWebPage> {
 
   NavigationDecision _onNavigationRequest(NavigationRequest request) {
     final uri = Uri.tryParse(request.url);
-    if (uri == null || !_isHttp(uri)) return NavigationDecision.prevent;
-    if (_allowsInApp(uri)) return NavigationDecision.navigate;
-    launchUrl(uri, mode: LaunchMode.externalApplication);
-    return NavigationDecision.prevent;
+    if (uri != null && shouldOpenWebUrlExternally(request.url)) {
+      launchUrl(uri, mode: LaunchMode.externalApplication);
+      return NavigationDecision.prevent;
+    }
+    if (uri == null || !_isAllowedWebUri(uri)) {
+      return NavigationDecision.prevent;
+    }
+    // Align with jinzhi-flutter-app: a normal HTTPS navigation stays in this
+    // WebView even when its host changes. H5 opts into an external handoff
+    // through `out`, which is handled above.
+    return NavigationDecision.navigate;
   }
 
-  bool _allowsInApp(Uri uri) {
-    final host = uri.host.toLowerCase();
-    if (host == widget.initialUri.host.toLowerCase()) return true;
-    return widget.allowedHosts.any(
-      (allowed) => host == allowed || host.endsWith('.$allowed'),
-    );
-  }
-
-  bool _isHttp(Uri uri) =>
-      uri.hasAuthority && (uri.scheme == 'https' || uri.scheme == 'http');
-
   Future<bool> _onPop() async {
     if (await _controller.canGoBack()) {
       await _controller.goBack();
@@ -118,6 +115,16 @@ class _AppWebPageState extends State<AppWebPage> {
 
 Uri? parseSafeWebUri(String? raw) {
   final uri = Uri.tryParse(raw?.trim() ?? '');
-  if (uri == null || !uri.hasAuthority) return null;
-  return uri.scheme == 'https' || uri.scheme == 'http' ? uri : null;
+  return uri != null && _isAllowedWebUri(uri) ? uri : null;
+}
+
+bool _isAllowedWebUri(Uri uri) {
+  if (!uri.hasAuthority || uri.host.isEmpty) return false;
+  if (uri.scheme.toLowerCase() == 'https') return true;
+  if (kReleaseMode || uri.scheme.toLowerCase() != 'http') return false;
+  return const {
+    'localhost',
+    '127.0.0.1',
+    '::1',
+  }.contains(uri.host.toLowerCase());
 }