fix: DNS 用 sing-box 1.12+ 新格式 + 引导仅首次显示

- clientconfig/mockserver:客户端配置 DNS 从 legacy address 串格式改为
  type+server 新格式(sing-box 1.13 对 legacy DNS 直接 FATAL,导致连不上)
- 引导页只首次:TokenStore 加 markOnboarded/isOnboarded;main.dart 登录后
  若已引导过直接进主界面,不再每次都弹引导

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

client/lib/main.dart

@@ -4,6 +4,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
 import 'pangolin_theme.dart';
+import 'services/token_store.dart';
 import 'shell/home_shell.dart';
 import 'state/app_providers.dart';
 import 'widgets/auth_screen.dart';
@@ -39,15 +40,29 @@ class RootFlow extends ConsumerStatefulWidget {
 
 class _RootFlowState extends ConsumerState<RootFlow> {
   AppStage stage = AppStage.auth;
+  final _store = const TokenStore();
+
+  // 登录后:引导只首次看过一次;之后直接进主界面。
+  Future<void> _afterAuth() async {
+    final onboarded = await _store.isOnboarded();
+    if (!mounted) return;
+    setState(() => stage = onboarded ? AppStage.app : AppStage.onboarding);
+  }
+
+  Future<void> _afterOnboarding() async {
+    await _store.markOnboarded();
+    if (!mounted) return;
+    setState(() => stage = AppStage.app);
+  }
 
   @override
   Widget build(BuildContext context) {
     final t = ref.watch(appTextProvider);
     switch (stage) {
       case AppStage.auth:
-        return AuthScreen(t: t, onDone: () => setState(() => stage = AppStage.onboarding));
+        return AuthScreen(t: t, onDone: () { _afterAuth(); });
       case AppStage.onboarding:
-        return OnboardingScreen(t: t, onDone: () => setState(() => stage = AppStage.app));
+        return OnboardingScreen(t: t, onDone: () { _afterOnboarding(); });
       case AppStage.app:
         return const HomeShell();
     }

client/lib/services/token_store.dart

@@ -13,6 +13,7 @@ class TokenStore {
 
   static const _kAccess = 'pangolin_access_token';
   static const _kRefresh = 'pangolin_refresh_token';
+  static const _kOnboarded = 'pangolin_onboarded';
 
   Future<void> saveTokens({
     required String access,
@@ -29,4 +30,8 @@ class TokenStore {
     await _storage.delete(key: _kAccess);
     await _storage.delete(key: _kRefresh);
   }
+
+  // 首次引导标记:引导页只在第一次看(看完置位,后续登录直接进主界面)。
+  Future<void> markOnboarded() => _storage.write(key: _kOnboarded, value: '1');
+  Future<bool> isOnboarded() async => (await _storage.read(key: _kOnboarded)) == '1';
 }

server/cmd/mockserver/main.go

@@ -22,7 +22,7 @@ import (
 // Fields match the nodes table columns: reality_public_key / reality_short_id / hy2_password.
 // In production the API renders these per-user from the nodes table.
 // Placeholders here are mock values for integration testing only.
-const connectConfig = `{"log":{"level":"warn","timestamp":true},"inbounds":[{"type":"tun","tag":"tun-in","address":["172.19.0.1/30"],"mtu":9000,"auto_route":true,"strict_route":true,"stack":"system"}],"outbounds":[{"type":"vless","tag":"reality-out","server":"18.136.60.128","server_port":11443,"uuid":"ffffffff-ffff-ffff-ffff-ffffffffffff","flow":"xtls-rprx-vision","tls":{"enabled":true,"server_name":"www.apple.com","utls":{"enabled":true,"fingerprint":"chrome"},"reality":{"enabled":true,"public_key":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","short_id":"deadbeef"}}},{"type":"hysteria2","tag":"hy2-out","server":"18.136.60.128","server_port":443,"password":"mock-hy2-password","tls":{"enabled":true,"insecure":true,"alpn":["h3"]}},{"type":"urltest","tag":"auto","outbounds":["reality-out","hy2-out"],"url":"https://www.gstatic.com/generate_204","interval":"3m","tolerance":50},{"type":"block","tag":"block"},{"type":"direct","tag":"direct"}],"route":{"rules":[{"ip_cidr":["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8"],"outbound":"direct"}],"final":"auto","auto_detect_interface":true},"dns":{"servers":[{"tag":"remote","address":"tls://8.8.8.8","detour":"auto"},{"tag":"local","address":"223.5.5.5","detour":"direct"}],"final":"remote","strategy":"ipv4_only"}}`
+const connectConfig = `{"log":{"level":"warn","timestamp":true},"inbounds":[{"type":"tun","tag":"tun-in","address":["172.19.0.1/30"],"mtu":9000,"auto_route":true,"strict_route":true,"stack":"system"}],"outbounds":[{"type":"vless","tag":"reality-out","server":"18.136.60.128","server_port":11443,"uuid":"ffffffff-ffff-ffff-ffff-ffffffffffff","flow":"xtls-rprx-vision","tls":{"enabled":true,"server_name":"www.apple.com","utls":{"enabled":true,"fingerprint":"chrome"},"reality":{"enabled":true,"public_key":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","short_id":"deadbeef"}}},{"type":"hysteria2","tag":"hy2-out","server":"18.136.60.128","server_port":443,"password":"mock-hy2-password","tls":{"enabled":true,"insecure":true,"alpn":["h3"]}},{"type":"urltest","tag":"auto","outbounds":["reality-out","hy2-out"],"url":"https://www.gstatic.com/generate_204","interval":"3m","tolerance":50},{"type":"block","tag":"block"},{"type":"direct","tag":"direct"}],"route":{"rules":[{"ip_cidr":["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8"],"outbound":"direct"}],"final":"auto","auto_detect_interface":true},"dns":{"servers":[{"tag":"remote","type":"tls","server":"8.8.8.8","detour":"auto"},{"tag":"local","type":"udp","server":"223.5.5.5","detour":"direct"}],"final":"remote","strategy":"ipv4_only"}}`
 
 var reConnect = regexp.MustCompile(`^/v1/nodes/[^/]+/connect$`)
 

server/internal/httpapi/clientconfig.go

@@ -119,10 +119,12 @@ func BuildClientConfig(node *nodes.NodeRow, dpUUID, deriveKey string) ([]byte, e
 	}
 
 	// DNS: remote over tunnel, local for domestic.
+	// sing-box 1.12+ DNS server format(type+server);旧的 address 串格式在
+	// 1.13 已 FATAL 拒绝(legacy DNS servers deprecated)。
 	dns := map[string]any{
 		"servers": []any{
-			map[string]any{"tag": "remote", "address": "tls://8.8.8.8", "detour": "auto"},
-			map[string]any{"tag": "local", "address": "223.5.5.5", "detour": "direct"},
+			map[string]any{"tag": "remote", "type": "tls", "server": "8.8.8.8", "detour": "auto"},
+			map[string]any{"tag": "local", "type": "udp", "server": "223.5.5.5", "detour": "direct"},
 		},
 		"final":    "remote",
 		"strategy": "ipv4_only",