added login

lib/app/app.dart

@@ -3,7 +3,9 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 
 import '../core/constants/app_constants.dart';
 import '../core/router/app_router.dart';
+import '../core/theme/app_colors.dart';
 import '../core/theme/app_theme.dart';
+import '../presentation/auth/providers/auth_controller.dart';
 import '../presentation/sync/providers/sync_controller.dart';
 
 class NearlePosApp extends ConsumerWidget {
@@ -15,6 +17,18 @@ class NearlePosApp extends ConsumerWidget {
     // behind it. Nothing on screen depends on this having finished.
     ref.watch(syncBootstrapProvider);
 
+    // This one *is* awaited. Re-opening a stored session is a keystore read —
+    // a few milliseconds — and building the router before it lands would show
+    // an already-signed-in terminal the login screen and then snatch it away.
+    final restored = ref.watch(sessionBootstrapProvider);
+
+    if (restored.isLoading) {
+      return const MaterialApp(
+        debugShowCheckedModeBanner: false,
+        home: ColoredBox(color: AppColors.background),
+      );
+    }
+
     return MaterialApp.router(
       title: AppConstants.appName,
       debugShowCheckedModeBanner: false,

lib/app/providers.dart

@@ -13,10 +13,12 @@ import '../data/remote/simulated_catalogue_source.dart';
 import '../data/remote/http_order_transport.dart';
 import '../data/remote/mqtt_order_transport.dart';
 import '../data/remote/order_transport.dart';
+import '../data/remote/pos_auth_api.dart';
 import '../data/remote/simulated_order_transport.dart';
 import '../data/repositories/store_repository_impl.dart';
 import '../data/repositories/sync_repository_impl.dart';
 import '../data/repositories/transaction_repository_impl.dart';
+import '../data/local/session_store.dart';
 import '../data/local/terminal_identity.dart';
 import '../data/sync/sync_engine.dart';
 import '../domain/repositories/customer_repository.dart';
@@ -31,6 +33,34 @@ import '../presentation/auth/providers/auth_controller.dart';
 /// Root data source. Overridden in tests with an in-memory double.
 final localStoreProvider = Provider<LocalStore>((ref) => LocalStore.instance);
 
+// ------------------------------------------------------------------- Auth
+/// Where the back office lives.
+///
+/// Its own provider, and deliberately free of any dependency on the session:
+/// [posAuthApiProvider] needs it *before* anyone is signed in, so a base URL
+/// derived from the session would be a cycle — sign-in needing the thing that
+/// sign-in produces.
+final backOfficeBaseUrlProvider = Provider<String>(
+  (ref) => 'https://fiesta.nearle.app/live/api/v1/pos',
+);
+
+/// Which back-office configuration this build's terminals belong to. Sent as
+/// `configid` on every sign-in.
+final posConfigIdProvider = Provider<int>((ref) => 1);
+
+/// `POST /login`. One client, closed when the endpoint is re-pointed.
+final posAuthApiProvider = Provider<PosAuthApi>((ref) {
+  final api = PosAuthApi(
+    baseUrl: ref.watch(backOfficeBaseUrlProvider),
+    configId: ref.watch(posConfigIdProvider),
+  );
+  ref.onDispose(api.dispose);
+  return api;
+});
+
+/// The signed-in session on disk, in the platform keystore.
+final sessionStoreProvider = Provider<SessionStore>((ref) => SessionStore());
+
 // ---------------------------------------------------------- Repositories
 final productRepositoryProvider = Provider<ProductRepository>(
   (ref) => ProductRepositoryImpl(ref.watch(localStoreProvider)),
@@ -91,7 +121,7 @@ final syncConfigProvider = StateProvider<SyncConfig>((ref) {
   final terminal = ref.watch(terminalIdentityProvider);
   return SyncConfig(
     transport: TransportKind.http,
-    httpBaseUrl: 'https://fiesta.nearle.app/live/api/v1/pos',
+    httpBaseUrl: ref.watch(backOfficeBaseUrlProvider),
     storeId: terminal.storeId,
     terminalId: terminal.code,
   );
@@ -164,7 +194,8 @@ final storeRepositoryProvider = Provider<StoreRepositoryImpl>(
 /// The outlet, refreshed whenever staff or details change.
 final storeAccountProvider = FutureProvider<StoreAccount>(
   (ref) => ref.watch(storeRepositoryProvider).load(
-        email: DemoCredentials.email,
+        // The account the terminal is signed in as, or blank before sign-in.
+        email: ref.watch(sessionAuthnameProvider),
       ),
 );