fix: DNS 用 sing-box 1.12+ 新格式 + 引导仅首次显示

- clientconfig/mockserver:客户端配置 DNS 从 legacy address 串格式改为
  type+server 新格式(sing-box 1.13 对 legacy DNS 直接 FATAL,导致连不上)
- 引导页只首次:TokenStore 加 markOnboarded/isOnboarded;main.dart 登录后
  若已引导过直接进主界面,不再每次都弹引导

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

client/lib/main.dart

@@ -4,6 +4,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
 import 'pangolin_theme.dart';
+import 'services/token_store.dart';
 import 'shell/home_shell.dart';
 import 'state/app_providers.dart';
 import 'widgets/auth_screen.dart';
@@ -39,15 +40,29 @@ class RootFlow extends ConsumerStatefulWidget {
 
 class _RootFlowState extends ConsumerState<RootFlow> {
   AppStage stage = AppStage.auth;
+  final _store = const TokenStore();
+
+  // 登录后:引导只首次看过一次;之后直接进主界面。
+  Future<void> _afterAuth() async {
+    final onboarded = await _store.isOnboarded();
+    if (!mounted) return;
+    setState(() => stage = onboarded ? AppStage.app : AppStage.onboarding);
+  }
+
+  Future<void> _afterOnboarding() async {
+    await _store.markOnboarded();
+    if (!mounted) return;
+    setState(() => stage = AppStage.app);
+  }
 
   @override
   Widget build(BuildContext context) {
     final t = ref.watch(appTextProvider);
     switch (stage) {
       case AppStage.auth:
-        return AuthScreen(t: t, onDone: () => setState(() => stage = AppStage.onboarding));
+        return AuthScreen(t: t, onDone: () { _afterAuth(); });
       case AppStage.onboarding:
-        return OnboardingScreen(t: t, onDone: () => setState(() => stage = AppStage.app));
+        return OnboardingScreen(t: t, onDone: () { _afterOnboarding(); });
       case AppStage.app:
         return const HomeShell();
     }