feat(mall): authenticate against the live API

Wave 2 of replacing the fixed-data mock adapter: the auth domain joins the live
list, so credentials, roles and tokens belong to the real user.

- session: validate a restored token through /auth/me instead of trusting
  localStorage, clearing it on 401/403 but keeping it when the API is merely
  unreachable; the route guard now uses the validated session
- login: report a 401 as invalid credentials rather than a generic failure, and
  drop the 6-character client rule so the API owns the password policy
- register: raise the rule to the API's 8 characters, remove the
  verification-code field (its button only counted down and the value was never
  sent), and report a duplicate email (409) distinctly
- TopBar and the user profile render their session-dependent branch client-only:
  validating the session before hydration made those localStorage-backed
  branches report hydration mismatches the previous code did not

Verified against the running backend: wrong password rejected, real JWT issued,
/user reachable, a short password refused with no network call, duplicate email
reported, a tampered token cleared and bounced to sign-in, a stale token kept
when the API is down, and the fixed-data rollback still signs in with the
backend stopped.

Also re-cuts docs/TBD-migrate-wave.md: auth is done, and cart, orders,
shipments and invoices must move together, because the mock adapter keeps their
state in one shared object and a partial flip fails at checkout.

OpenSpec change: openspec/changes/replace-mock-api-wave-2

apps/mall/locales/auth.ts

@@ -29,9 +29,11 @@ export default {
       resetSuccessHint: "Your password has been reset. Sign in with your new password.",
       validationRequired: "Please complete all required fields.",
       validationEmail: "Enter a valid email address.",
-      validationPassword: "Password must be at least 6 characters.",
+      validationPassword: "Password must be at least 8 characters.",
       validationMismatch: "Passwords do not match.",
       requestFailed: "Unable to complete this request. Please try again.",
+      invalidCredentials: "Incorrect email or password.",
+      emailTaken: "That email is already registered.",
     },
   },
   zh: {
@@ -64,9 +66,11 @@ export default {
       resetSuccessHint: "您的密码已重置，请使用新密码登录。",
       validationRequired: "请填写所有必填项。",
       validationEmail: "请输入有效的邮箱地址。",
-      validationPassword: "密码至少需要 6 位。",
+      validationPassword: "密码至少需要 8 位。",
       validationMismatch: "两次输入的密码不一致。",
       requestFailed: "操作失败，请稍后重试。",
+      invalidCredentials: "邮箱或密码不正确。",
+      emailTaken: "该邮箱已被注册。",
     },
   },
 };