test(client): L2 点连接能连上 流程 + ConnectApi 注入(支柱1)

- connection_provider:加 connectApiFactoryProvider(原内部 new ConnectApi 改成
  可注入工厂,支柱1 接缝即接口)——默认行为不变
- test/unit/flow_connect_test.dart:真 toggle → fetchConfig(注入 MockClient 回占位
  config)→ bridge.start → statusStream 确认 → on → 再 toggle → off;
  验证「非乐观翻转」红线(on 必由 bridge 确认)
- 全量 unit/widget 47 全过(重构不破坏)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

client/lib/state/connection_provider.dart

@@ -136,7 +136,7 @@ class ConnectionController extends StateNotifier<ConnectionState> {
     Future<String> doFetch() {
       final token = _ref.read(authProvider).accessToken ?? '';
       _api?.dispose();
-      _api = ConnectApi(baseUrl: kApiBaseUrl, authToken: token);
+      _api = _ref.read(connectApiFactoryProvider)(token);
       return _api!.fetchConfig(
         nodeId: nodeUuid,
         deviceId: _kDeviceId,
@@ -215,3 +215,11 @@ final connectionProvider =
 final vpnStatsProvider = StreamProvider<VpnStatsEvent>(
   (ref) => ref.watch(vpnBridgeProvider).statsStream,
 );
+
+/// 按 authToken 造 ConnectApi 的工厂(支柱 1:接缝即接口)。默认走真控制面;
+/// 测试 override 注入 MockClient,即可驱动「连接成功」路径而不打真网络。
+typedef ConnectApiFactory = ConnectApi Function(String authToken);
+
+final connectApiFactoryProvider = Provider<ConnectApiFactory>(
+  (_) => (authToken) => ConnectApi(baseUrl: kApiBaseUrl, authToken: authToken),
+);