feat(client): 全模块 API 对接 + 修复登陆跳转 + 菜单 UI 优化

API 对接：
- 入库/出库/库存/财务/往来单位/基础数据全部对接后端 REST API
- 新增 repositories、providers、models 层，统一分层架构
- auth 从 flutter_secure_storage 迁移到 shared_preferences

登陆跳转修复：
- 将 _RouterNotifier 提取为独立 Riverpod provider，appRouterProvider
  使用 ref.read 避免依赖链导致 router 重建后跳回 /login
- redirect 函数新增 initialized 守卫，防止 auth 未恢复时误重定向
- 添加调试日志（Router/Auth/ApiClient）定位 401 触发的 logout 链路

退出菜单 UI：
- 去掉 ListTile，改用 Row + 自定义 padding，文字左对齐
- MouseRegion + AnimatedContainer 实现 hover 高亮（普通项蓝底/退出红底）
- 菜单圆角 6px，elevation 8，分割线高度 1px

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

client/lib/core/router/app_router.dart

@@ -17,18 +17,55 @@ import '../auth/auth_state.dart';
 Page<void> _noTransition(Widget child) =>
     NoTransitionPage<void>(child: child);
 
-final appRouterProvider = Provider<GoRouter>((ref) {
-  final authState = ref.watch(authStateProvider);
+/// ChangeNotifier that bridges Riverpod auth state → GoRouter refreshListenable.
+class _RouterNotifier extends ChangeNotifier {
+  final Ref _ref;
 
-  return GoRouter(
+  _RouterNotifier(this._ref) {
+    _ref.listen<AuthState>(authStateProvider, (prev, next) {
+      debugPrint('[Router] authState changed:'
+          ' initialized=${next.initialized}'
+          ' isLoggedIn=${next.isLoggedIn}'
+          ' user=${next.user?.username}');
+      notifyListeners();
+    });
+  }
+
+  String? redirect(BuildContext context, GoRouterState state) {
+    final authState = _ref.read(authStateProvider);
+    final isLoggedIn = authState.isLoggedIn;
+    final isLoginRoute = state.matchedLocation == '/login';
+    final result = !authState.initialized
+        ? null
+        : (!isLoggedIn && !isLoginRoute)
+            ? '/login'
+            : (isLoggedIn && isLoginRoute)
+                ? '/stock-in'
+                : null;
+    debugPrint('[Router] redirect: location=${state.matchedLocation}'
+        ' initialized=${authState.initialized}'
+        ' isLoggedIn=$isLoggedIn'
+        ' → ${result ?? "null (no redirect)"}');
+    return result;
+  }
+}
+
+/// Separate provider so that appRouterProvider has NO dependencies and
+/// is never rebuilt when auth state changes (prevents router reset to /login).
+final _routerNotifierProvider = Provider<_RouterNotifier>((ref) {
+  final notifier = _RouterNotifier(ref);
+  ref.onDispose(notifier.dispose);
+  return notifier;
+});
+
+final appRouterProvider = Provider<GoRouter>((ref) {
+  // Use ref.read (not ref.watch) so appRouterProvider never rebuilds on auth change.
+  final notifier = ref.read(_routerNotifierProvider);
+
+  final router = GoRouter(
     initialLocation: '/login',
-    redirect: (context, state) {
-      final isLoggedIn = authState.isLoggedIn;
-      final isLoginRoute = state.matchedLocation == '/login';
-      if (!isLoggedIn && !isLoginRoute) return '/login';
-      if (isLoggedIn && isLoginRoute) return '/stock-in';
-      return null;
-    },
+    refreshListenable: notifier,
+    redirect: notifier.redirect,
     routes: [
       GoRoute(
         path: '/login',
@@ -70,4 +107,8 @@ final appRouterProvider = Provider<GoRouter>((ref) {
       ),
     ],
   );
+
+  ref.onDispose(router.dispose);
+
+  return router;
 });