docs: 会话安全方案文档 + 本地测试脚本

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/local_test.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# local_test.sh — 本地编译一份「指向线上后端」的 macOS app 并启动，用于发版前自测。
+#
+# 用法：
+#   sh scripts/local_test.sh            # 编译 + 启动
+#   sh scripts/local_test.sh --no-open  # 只编译不启动
+#
+# 后端固定指向生产 https://jiu.51yanmei.com（与 CI compile-macos.sh 一致）。
+set -euo pipefail
+
+export PATH="/opt/homebrew/bin:$PATH"
+
+# 版本号：取最新 client-v* tag 的 patch+1，纯展示用，取不到则回退 0.0.0-dev。
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+LATEST_TAG="$(git describe --tags --match 'client-v*' --abbrev=0 2>/dev/null || true)"
+if [ -n "$LATEST_TAG" ]; then
+  BASE_VER="${LATEST_TAG#client-v}"
+  MAJOR_MINOR="${BASE_VER%.*}"
+  PATCH="${BASE_VER##*.}"
+  VER="${MAJOR_MINOR}.$((PATCH + 1))"
+else
+  VER="0.0.0-dev"
+fi
+
+APP="client/build/macos/Build/Products/Release/jiu_client.app"
+
+echo "==> 编译 macOS app（线上后端，版本 v${VER}）"
+cd client
+flutter build macos --release \
+  "--dart-define=BASE_URL=https://jiu.51yanmei.com" \
+  "--dart-define=PUBLIC_URL=https://jiu.51yanmei.com" \
+  "--dart-define=APP_VERSION=v${VER}"
+cd "$REPO_ROOT"
+
+echo "==> 产物：$APP"
+
+if [ "${1:-}" = "--no-open" ]; then
+  echo "==> 跳过启动（--no-open）"
+else
+  echo "==> 前台启动 app（终端附着日志，退出 app 才返回；Ctrl-C 可终止）"
+  exec "$APP/Contents/MacOS/jiu_client"
+fi