fix：参考金值，研听，研值工程通用通用工程公共能力，重点对比网络请求、登录认证、状态管理、本地存储、WebView、推送、版本更新、一键登录、主题/UI 等模块，确定后续统一整改方案

test/common/network/auth_interceptor_test.dart

@@ -0,0 +1,74 @@
+import 'dart:typed_data';
+
+import 'package:dio/dio.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:jinzhi_flutter_app/common/network/auth_interceptor.dart';
+import 'package:jinzhi_flutter_app/common/storage/preferences_storage.dart';
+import 'package:jinzhi_flutter_app/common/storage/secure_identity_storage.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  test('external absolute URLs lose all backend identity headers', () async {
+    SharedPreferences.setMockInitialValues({});
+    final preferences = await SharedPreferences.getInstance();
+    final session = AuthSessionStorage(
+      SecureIdentityStorage(
+        PreferencesStorage(preferences),
+        secureStorage: _MemorySecureStorage(),
+      ),
+    );
+    final dio = Dio(BaseOptions(baseUrl: 'https://api.example.com'))
+      ..interceptors.add(
+        AuthInterceptor(
+          session,
+          backendOrigin: Uri.parse('https://api.example.com'),
+        ),
+      )
+      ..httpClientAdapter = _CaptureAdapter();
+
+    final response = await dio.get<void>(
+      'https://cdn.example.net/ad.png',
+      options: Options(
+        headers: {
+          'Authorization': 'Bearer leaked',
+          'X-Device-Id': 'device',
+          'User-iOS-IDFA': 'idfa',
+          'User-DeviceToken': 'push',
+        },
+      ),
+    );
+
+    final headers = response.requestOptions.headers.keys
+        .map((key) => key.toLowerCase())
+        .toSet();
+    expect(headers, isNot(contains('authorization')));
+    expect(headers, isNot(contains('x-device-id')));
+    expect(headers, isNot(contains('user-ios-idfa')));
+    expect(headers, isNot(contains('user-devicetoken')));
+  });
+}
+
+class _MemorySecureStorage implements SecureKeyValueStorage {
+  final Map<String, String> values = {};
+
+  @override
+  Future<void> delete(String key) async => values.remove(key);
+  @override
+  Future<String?> read(String key) async => values[key];
+  @override
+  Future<void> write(String key, String value) async => values[key] = value;
+}
+
+class _CaptureAdapter implements HttpClientAdapter {
+  @override
+  Future<ResponseBody> fetch(
+    RequestOptions options,
+    Stream<Uint8List>? requestStream,
+    Future<void>? cancelFuture,
+  ) async => ResponseBody.fromString('', 204);
+
+  @override
+  void close({bool force = false}) {}
+}