Sign the terminal in against the back office instead of against two constants

Sign-in compared `admin@nearle.in` / `nearle123` — a compile-time const — after
a 600ms delay standing in for a network call that was never made. Two things
followed, and the second was the serious one.

Every install of a build shared one password, and changing it meant a rebuild.
Worse: because nothing was checked with the back office, the *outlet* could not
come from the sign-in. It came from a store id typed into Settings, so the till
asserted which shop it belonged to and the server took its word. One field on
one screen moved a terminal into another tenant's books.

Now a person signs in with their own back-office account and the outlet arrives
as a consequence — sealed in a signed token, checked server-side on every
request, and not editable from this device. `DemoCredentials` is gone, along
with the prefilled fields and the "Demo account" hint that printed the password
on the login screen.

The pieces:

- `PosSession` — what the back office answers with. The token is opaque on
  purpose: the till must not parse it or reason about what it appears to say.
- `SessionStore` — the whole session to the platform keystore, not SQLite. The
  token is a bearer credential and SQLite here is a file behind a shop counter.
  An expired session reads back as absent, so no caller has to remember to
  check.
- `SyncConfig.bearerToken` — one accessor rather than the same `??` at each
  call site, because the request that forgot it would be the one silently
  sending no credentials. The session beats a static API key: the key says the
  request came from our fleet, the session says which outlet it came from, and
  only the second can stop a till reaching another tenant's books.
- Restore runs in `syncBootstrapProvider` *before* the engine starts. A drain
  that began first would upload the day's bills unauthenticated. A till trades
  all day; a reboot mid-shift must not put a login screen in front of a queue.
- An outlet picker, shown only when the account genuinely reaches several. Not
  dismissable — defaulting silently to the first outlet is how a day's takings
  end up filed against the wrong shop.

Store name, address, GSTIN and phone now come down with the session and are
written on sign-in. They were compile-time constants, and on a GST invoice
those fields are a legal requirement rather than decoration.

The smoke test signs in through a fake client and inside `runAsync`: sign-in
reaches SQLite now, and real disk I/O cannot complete on a widget test's fake
clock — pumping alone leaves it suspended for ever.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

lib/app/providers.dart

@@ -17,7 +17,9 @@ import '../data/remote/simulated_order_transport.dart';
 import '../data/repositories/store_repository_impl.dart';
 import '../data/repositories/sync_repository_impl.dart';
 import '../data/repositories/transaction_repository_impl.dart';
+import '../data/local/session_store.dart';
 import '../data/local/terminal_identity.dart';
+import '../data/remote/pos_auth_api.dart';
 import '../data/sync/sync_engine.dart';
 import '../domain/repositories/customer_repository.dart';
 import '../domain/repositories/product_repository.dart';
@@ -161,10 +163,28 @@ final storeRepositoryProvider = Provider<StoreRepositoryImpl>(
   (ref) => StoreRepositoryImpl(ref.watch(localStoreProvider)),
 );
 
+/// Signs a terminal in against the back office.
+///
+/// Points at the same base URL the uplinks use, so re-pointing a terminal in
+/// Settings moves its sign-in with it rather than leaving it authenticating
+/// against the endpoint it used to belong to.
+final posAuthApiProvider = Provider<PosAuthApi>((ref) {
+  final api = PosAuthApi(baseUrl: ref.watch(syncConfigProvider).httpBaseUrl);
+  ref.onDispose(api.dispose);
+  return api;
+});
+
+/// Where the signed session survives a restart.
+final sessionStoreProvider = Provider<SessionStore>((ref) => SessionStore());
+
 /// The outlet, refreshed whenever staff or details change.
+///
+/// The email is the signed-in account's, not a constant. It used to be
+/// `DemoCredentials.email` — the same address on every install of a build,
+/// which is what made the store login decorative.
 final storeAccountProvider = FutureProvider<StoreAccount>(
   (ref) => ref.watch(storeRepositoryProvider).load(
-        email: DemoCredentials.email,
+        email: ref.watch(authControllerProvider.notifier).session?.email ?? '',
       ),
 );