fix：优化和对齐版本

lib/common/network/auth_interceptor.dart

@@ -1,16 +1,19 @@
 import 'package:dio/dio.dart';
-import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
 import '../services/device_header_service.dart';
+import '../storage/secure_identity_storage.dart';
 
-const _kJwtKey = 'jwt_token';
-const _storage = FlutterSecureStorage();
+final _defaultIdentityStorage = SecureIdentityStorage();
 
-Future<void> saveJwt(String token) =>
-    _storage.write(key: _kJwtKey, value: token);
-Future<void> clearJwt() => _storage.delete(key: _kJwtKey);
-Future<String?> loadJwt() => _storage.read(key: _kJwtKey);
+Future<void> saveJwt(String token) => _defaultIdentityStorage.saveJwt(token);
+Future<void> clearJwt() => _defaultIdentityStorage.clearJwt();
+Future<String?> loadJwt() => _defaultIdentityStorage.readJwt();
 
 class AuthInterceptor extends Interceptor {
+  AuthInterceptor(this._identityStorage);
+
+  final SecureIdentityStorage _identityStorage;
+
   @override
   Future<void> onRequest(
     RequestOptions options,
@@ -19,7 +22,7 @@ class AuthInterceptor extends Interceptor {
     await DeviceHeaderService.to.ensureInitialized();
     options.headers.addAll(DeviceHeaderService.to.commonHeaders());
     options.headers.addAll(DeviceHeaderService.to.platformIdentityHeaders());
-    final jwt = await loadJwt();
+    final jwt = await _identityStorage.readJwt();
     if (jwt != null && jwt.isNotEmpty) {
       options.headers['Authorization'] = 'Bearer $jwt';
     }

lib/common/network/dio_provider.dart

@@ -5,6 +5,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 
 import '../config/app_config.dart';
+import '../storage/secure_identity_storage.dart';
 import 'auth_interceptor.dart';
 import 'kratos_error_interceptor.dart';
 
@@ -12,12 +13,20 @@ part 'dio_provider.g.dart';
 
 const _protobufContentType = 'application/x-protobuf';
 
+/// Per-request override for native protobuf-over-HTTP endpoints.
+Options protobufOptions() => Options(
+  responseType: ResponseType.bytes,
+  contentType: _protobufContentType,
+  headers: const {'Accept': _protobufContentType},
+);
+
 @Riverpod(keepAlive: true)
 AppConfig appConfig(Ref ref) => AppConfig.fromEnvironment();
 
 @Riverpod(keepAlive: true)
 Dio dio(Ref ref) {
   final config = ref.watch(appConfigProvider);
+  final identityStorage = ref.watch(secureIdentityStorageProvider);
   final d = Dio(
     BaseOptions(
       baseUrl: config.apiBaseUrl,
@@ -31,7 +40,7 @@ Dio dio(Ref ref) {
       },
     ),
   );
-  d.interceptors.add(AuthInterceptor());
+  d.interceptors.add(AuthInterceptor(identityStorage));
   d.interceptors.add(KratosErrorInterceptor());
   if (!kReleaseMode) {
     d.interceptors.add(LogInterceptor(requestBody: false, responseBody: false));