fix: improve transfer recognition and local data safety

frontend/lib/shared/api/api_client.dart

@@ -1,9 +1,7 @@
-import 'dart:io';
-
 import 'package:dio/dio.dart';
-import 'package:dio/io.dart';
 import 'package:flutter/foundation.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:miaoji_zhang/shared/api/backend_identity.dart';
 import 'package:miaoji_zhang/shared/services/session_store.dart';
 
 class ApiClient {
@@ -11,24 +9,14 @@ class ApiClient {
   static final ApiClient instance = ApiClient._();
 
   static const _storage = FlutterSecureStorage();
-  static const _tokenKey = 'auth_token';
+  static const _legacyTokenKey = 'auth_token';
+  static final _tokenKey = 'auth_token_${BackendIdentity.scope}';
   static final sessionExpired = ValueNotifier<int>(0);
   static bool _handlingUnauthorized = false;
-  static const _internalBuild = bool.fromEnvironment('INTERNAL_BUILD');
-  static const _internalTestBaseUrl = 'https://lt.frp-say.com:38012';
-  static const _configuredBaseUrl = String.fromEnvironment('API_BASE_URL');
-  static const _temporaryFrpHost = 'lt.frp-say.com';
-  static const _temporaryFrpPort = 38012;
-  static const _temporaryFrpCertificateSha1 =
-      '509C3210161E72FB9DA5183D3D2152F63871C31F';
 
-  static const String baseUrl = _configuredBaseUrl != ''
-      ? _configuredBaseUrl
-      : _internalBuild
-      ? _internalTestBaseUrl
-      : 'https://api.invalid';
+  static const String baseUrl = BackendIdentity.baseUrl;
 
-  static bool get isInternalBuild => _internalBuild;
+  static bool get isInternalBuild => BackendIdentity.internalBuild;
 
   late final Dio dio = _createDio();
 
@@ -77,35 +65,19 @@ class ApiClient {
             ),
           );
 
-    final apiUri = Uri.tryParse(baseUrl);
-    if (_internalBuild &&
-        apiUri?.scheme == 'https' &&
-        apiUri?.host == _temporaryFrpHost &&
-        apiUri?.port == _temporaryFrpPort) {
-      client.httpClientAdapter = IOHttpClientAdapter(
-        createHttpClient: () {
-          final httpClient = HttpClient();
-          httpClient.badCertificateCallback = (certificate, host, port) {
-            final certificateSha1 = certificate.sha1
-                .map((byte) => byte.toRadixString(16).padLeft(2, '0'))
-                .join()
-                .toUpperCase();
-            return host == _temporaryFrpHost &&
-                port == _temporaryFrpPort &&
-                certificateSha1 == _temporaryFrpCertificateSha1;
-          };
-          return httpClient;
-        },
-      );
-    }
-
     return client;
   }
 
-  Future<void> saveToken(String token) =>
-      _storage.write(key: _tokenKey, value: token);
+  Future<void> saveToken(String token) async {
+    await _storage.write(key: _tokenKey, value: token);
+    await _storage.delete(key: _legacyTokenKey);
+  }
+
   Future<String?> readToken() => _storage.read(key: _tokenKey);
-  Future<void> clearToken() => _storage.delete(key: _tokenKey);
+  Future<void> clearToken() async {
+    await _storage.delete(key: _tokenKey);
+    await _storage.delete(key: _legacyTokenKey);
+  }
 }
 
 bool isConnectivityError(Object error) =>