refactor: 只保留 Web，移除 Capacitor 原生壳

删除 android/、ios/ 两个 Capacitor 原生工程与 capacitor.config.ts、
ionic.config.json，以及 scripts/android、scripts/ios.sh 构建脚本；
根与 apps/web 的 @capacitor/* 依赖和相关 npm scripts 一并移除。

Web 侧去掉原生分支：登录只走云乐坊容器授权面板或顶层重定向，
暗色模式不再改原生状态栏，移除 Android 物理返回键处理。

保留 @nuxtjs/ionic（Web UI 框架）、云乐坊 window.ylf 桥接与 PWA。

决策记录见 docs/decisions/0004-web-only.md。

apps/web/app/utils/dialog.ts

@@ -2,7 +2,7 @@ import { actionSheetController, alertController } from '@ionic/vue'
 import { yunleHaptic } from './yunleHost'
 
 /**
- * iOS 风格的弹窗：替代 @capacitor/dialog（Web 上会退化成 window.alert / confirm / prompt）
+ * iOS 风格的弹窗：统一走 Ionic 的 alert / actionSheet
  */
 
 export async function showAlert(header: string, message: string): Promise<void> {

apps/web/app/utils/nativeSso.ts

@@ -1,211 +0,0 @@
-import type {
-  AcquisitionContext,
-  RedirectSsoOptions,
-  SsoAuthorizationResult,
-  SsoRedirectResult,
-} from '@yunlefun/sso'
-import {
-  buildSsoRequestUrl,
-  deriveSsoPkceChallenge,
-  isSsoPkceVerifier,
-  parseSsoRedirectResult,
-  readSsoClientId,
-  readSsoRedirectUri,
-  readSsoScope,
-  sanitizeAcquisitionContext,
-  YLF_DEFAULT_SSO_ORIGIN,
-} from '@yunlefun/sso'
-
-const TRANSACTION_TTL_MS = 10 * 60 * 1000
-const NONCE_RE = /^[\w-]{32,128}$/
-const BASE64_PADDING_RE = /=+$/
-
-export interface NativeSsoTransaction {
-  clientId: string
-  codeVerifier: string
-  createdAt: number
-  issuer: string
-  nonce: string
-  redirectUri: string
-  scope: string[]
-  acquisition?: AcquisitionContext
-}
-
-export interface NativeSsoTransactionStore {
-  clear: () => Promise<void>
-  load: () => Promise<NativeSsoTransaction | null>
-  save: (transaction: NativeSsoTransaction) => Promise<void>
-}
-
-export interface NativeSsoDependencies {
-  now?: () => number
-  randomBase64Url?: () => string
-}
-
-export async function beginNativeSsoRedirect(
-  options: RedirectSsoOptions,
-  store: NativeSsoTransactionStore,
-  dependencies: NativeSsoDependencies = {},
-): Promise<string> {
-  const issuer = new URL(options.ssoOrigin ?? YLF_DEFAULT_SSO_ORIGIN).origin
-  const random = dependencies.randomBase64Url ?? (() => randomBase64Url(32))
-  const nonce = random()
-  const codeVerifier = random()
-  const codeChallenge = await deriveSsoPkceChallenge(codeVerifier)
-  const acquisition = sanitizeAcquisitionContext(options.acquisition)
-  const authorizationUrl = buildSsoRequestUrl({
-    clientId: options.clientId,
-    codeChallenge,
-    nonce,
-    redirectUri: options.redirectUri,
-    scope: options.scope,
-    ssoOrigin: issuer,
-    ...(options.prompt ? { prompt: options.prompt } : {}),
-    ...(acquisition ? { acquisition } : {}),
-  })
-
-  await store.save({
-    clientId: options.clientId,
-    codeVerifier,
-    createdAt: (dependencies.now ?? Date.now)(),
-    issuer,
-    nonce,
-    redirectUri: options.redirectUri,
-    scope: [...options.scope],
-    ...(acquisition ? { acquisition } : {}),
-  })
-
-  return authorizationUrl
-}
-
-export async function openNativeSsoRedirect(
-  options: RedirectSsoOptions,
-  store: NativeSsoTransactionStore,
-  open: (url: string) => Promise<void>,
-  dependencies: NativeSsoDependencies = {},
-): Promise<void> {
-  const url = await beginNativeSsoRedirect(options, store, dependencies)
-  try {
-    await open(url)
-  }
-  catch (error) {
-    await store.clear()
-    throw error
-  }
-}
-
-export async function consumeNativeSsoCallback(
-  callbackUrl: string,
-  store: NativeSsoTransactionStore,
-  dependencies: Pick<NativeSsoDependencies, 'now'> = {},
-): Promise<SsoAuthorizationResult | Extract<SsoRedirectResult, { ok: false }> | null> {
-  const stored = await store.load()
-  await store.clear()
-
-  const transaction = normalizeTransaction(stored)
-  const now = (dependencies.now ?? Date.now)()
-  if (!transaction
-    || transaction.createdAt + TRANSACTION_TTL_MS <= now
-    || !callbackMatchesRedirect(callbackUrl, transaction.redirectUri)) {
-    return null
-  }
-
-  const result = parseSsoRedirectResult({
-    expectedIssuer: transaction.issuer,
-    expectedNonce: transaction.nonce,
-    hash: new URL(callbackUrl).hash,
-  })
-  if (!result?.ok)
-    return result
-
-  return Object.freeze({
-    ...result,
-    clientId: transaction.clientId,
-    codeVerifier: transaction.codeVerifier,
-    redirectUri: transaction.redirectUri,
-    scope: Object.freeze([...transaction.scope]),
-    ...(transaction.acquisition ? { acquisition: transaction.acquisition } : {}),
-  })
-}
-
-export function isNativeSsoCallbackUrl(callbackUrl: string, redirectUri: string): boolean {
-  return callbackMatchesRedirect(callbackUrl, redirectUri)
-}
-
-export function stripNativeSsoCallbackHash(callbackUrl: string): string {
-  try {
-    const url = new URL(callbackUrl)
-    return `${url.pathname}${url.search}`
-  }
-  catch {
-    return ''
-  }
-}
-
-function callbackMatchesRedirect(callbackUrl: string, redirectUri: string): boolean {
-  try {
-    const callback = new URL(callbackUrl)
-    const callbackWithoutHash = `${callback.origin}${callback.pathname}${callback.search}`
-    return callback.protocol === 'https:'
-      && !callback.username
-      && !callback.password
-      && Boolean(callback.hash)
-      && callbackWithoutHash === redirectUri
-  }
-  catch {
-    return false
-  }
-}
-
-function normalizeTransaction(value: NativeSsoTransaction | null): NativeSsoTransaction | null {
-  if (!value)
-    return null
-
-  const clientId = readSsoClientId(value.clientId)
-  const redirectUri = readSsoRedirectUri(value.redirectUri)
-  const scope = readSsoScope(value.scope.join(' '))
-  let issuer = ''
-  try {
-    const issuerUrl = new URL(value.issuer)
-    issuer = issuerUrl.protocol === 'https:' && issuerUrl.origin === value.issuer
-      ? issuerUrl.origin
-      : ''
-  }
-  catch {
-    issuer = ''
-  }
-
-  if (!clientId
-    || !redirectUri
-    || scope.length === 0
-    || !issuer
-    || !NONCE_RE.test(value.nonce)
-    || !isSsoPkceVerifier(value.codeVerifier)
-    || !Number.isSafeInteger(value.createdAt)) {
-    return null
-  }
-
-  const acquisition = sanitizeAcquisitionContext(value.acquisition)
-  return {
-    clientId,
-    codeVerifier: value.codeVerifier,
-    createdAt: value.createdAt,
-    issuer,
-    nonce: value.nonce,
-    redirectUri,
-    scope,
-    ...(acquisition ? { acquisition } : {}),
-  }
-}
-
-function randomBase64Url(byteLength: number): string {
-  const bytes = new Uint8Array(byteLength)
-  globalThis.crypto.getRandomValues(bytes)
-  let binary = ''
-  for (const byte of bytes)
-    binary += String.fromCharCode(byte)
-  return globalThis.btoa(binary)
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replace(BASE64_PADDING_RE, '')
-}

apps/web/app/utils/yunleHost.ts

@@ -1,6 +1,6 @@
 /**
  * 云乐坊 App 内嵌容器（apps.yunle.fun）注入的 `window.ylf` JSAPI。
- * 普通浏览器与 Cook 自己的 Capacitor 外壳中不存在，所有调用都要特性检测。
+ * 普通浏览器中不存在，所有调用都要特性检测。
  *
  * @see https://github.com/YunLeFun/apps.yunle.fun/blob/main/docs/guide/jsapi.md
  */

apps/web/app/utils/yunlefunAuth.ts

@@ -48,15 +48,13 @@ export interface YunlefunAuthController {
 
 interface YunlefunAuthControllerOptions {
   identity: YunlefunIdentityAdapter
-  native: YunlefunAuthorizationAdapter
-  platform: 'native' | 'web'
   web: YunlefunAuthorizationAdapter
 }
 
 export function createYunlefunAuthController(
   options: YunlefunAuthControllerOptions,
 ): YunlefunAuthController {
-  const authorization = options.platform === 'native' ? options.native : options.web
+  const authorization = options.web
   let initialized = false
   let state: YunlefunAuthSnapshot = {
     account: null,

apps/web/app/utils/yunlefunSsoConfig.ts

@@ -9,8 +9,6 @@ export interface YunlefunSsoConfigInput {
   clientId?: string
   cloudbaseEnv?: string
   exchangeUrl?: string
-  nativeClientId?: string
-  nativeRedirectUri?: string
   redirectUri?: string
   redirectUris?: string | string[]
   scope?: string
@@ -19,7 +17,6 @@ export interface YunlefunSsoConfigInput {
 
 export interface YunlefunSsoConfigContext {
   currentOrigin: string
-  platform: 'native' | 'web'
 }
 
 export interface YunlefunSsoConfig {
@@ -39,22 +36,18 @@ export function resolveYunlefunSsoConfig(
   input: YunlefunSsoConfigInput,
   context: YunlefunSsoConfigContext,
 ): YunlefunSsoConfigResult {
-  const clientId = readSsoClientId(
-    context.platform === 'native' ? input.nativeClientId : input.clientId,
-  )
+  const clientId = readSsoClientId(input.clientId)
   const cloudbaseEnv = normalizeValue(input.cloudbaseEnv)
   const exchangeUrl = readSsoRedirectUri(input.exchangeUrl)
   const webRedirectUris = readWebRedirectUris(input.redirectUris ?? input.redirectUri)
-  const redirectUri = context.platform === 'native'
-    ? readSsoRedirectUri(input.nativeRedirectUri)
-    : webRedirectUris.find(uri => new URL(uri).origin === context.currentOrigin)
+  const redirectUri = webRedirectUris.find(uri => new URL(uri).origin === context.currentOrigin)
   const scope = readSsoScope(input.scope)
   const ssoOrigin = normalizeHttpsOrigin(input.ssoOrigin)
 
   if (!clientId
     || !CLOUDBASE_ENV_RE.test(cloudbaseEnv)
     || !exchangeUrl
-    || (context.platform === 'native' ? !redirectUri : webRedirectUris.length === 0)
+    || webRedirectUris.length === 0
     || scope.length === 0
     || !ssoOrigin) {
     return {