feat(taobao): add native mini program with shared backend

Preserve H5 flows while adding Taobao identity, native capture, reports and isolated local development. Fix canceled province selection and expired-session logout. Record passing local regressions, two pre-existing H5 assertion failures and pending platform validation.

taobao/test/session.test.cjs

@@ -0,0 +1,37 @@
+'use strict';
+const { test } = require('node:test'), assert = require('node:assert/strict');
+const fs = require('node:fs'), path = require('node:path'), vm = require('node:vm');
+
+test('logout succeeds for an expired session, while a failed server revocation remains visible', async () => {
+  const storage = new Map(), app = { globalData: {} };
+  let logoutFailure;
+  const module = { exports: {} };
+  vm.runInNewContext(fs.readFileSync(path.join(__dirname, '../utils/api.js'), 'utf8'), {
+    module, Promise, Date, setTimeout, getApp: () => app,
+    my: { setStorageSync: ({ key, data }) => storage.set(key, data),
+      getStorageSync: ({ key }) => ({ data: storage.get(key) }), removeStorageSync: ({ key }) => storage.delete(key) },
+    require(name) {
+      if (name === '../config') return { transport: 'direct' };
+      if (name === './transport') return { request: async route => {
+        if (route.endsWith('/challenge')) return { ok: true, challenge: 'challenge' };
+        if (route.endsWith('/session')) return { ok: true, token: 'token', user: { id: 'alice' } };
+        if (route.endsWith('/logout')) {
+          if (logoutFailure === 'network') throw Error('network unavailable');
+          return { ok: false, http_status: 401, message: 'session expired' };
+        }
+        throw Error('unexpected route: ' + route);
+      } };
+      throw Error('unexpected dependency: ' + name);
+    }
+  });
+  const api = module.exports;
+  await api.login(true);
+  logoutFailure = 'network';
+  await assert.rejects(api.logout(), /network unavailable/);
+  assert.equal(api.user().id, 'alice');
+  app.globalData.photos = ['private-photo']; app.globalData.payload = { private: true };
+  logoutFailure = 'expired';
+  await api.logout();
+  assert.equal(api.user(), null); assert.equal(storage.size, 0);
+  assert.equal(app.globalData.photos, null); assert.equal(app.globalData.payload, null);
+});