refactor(auth): switch to class-based social login and v4 route handler

Migrate from function-based social login helpers (`facebookLogin`, `googleLogin`)
to class-based services (`new FacebookLogin().signIn()`, `new GoogleLogin().signIn()`),
updating call sites in `AuthFacebookPanel` and `SplashButton` with try/catch error
handling. The NextAuth route handler is also refactored to the v4 pattern, importing
pre-built `GET` / `POST` exports from `@/lib/auth/nextauth` instead of constructing
the handler inline with `NextAuth(authOptions)`.

src/stores/auth/auth-machine.ts

@@ -4,7 +4,8 @@
  * 原始 Dart: lib/ui/auth/bloc/auth_bloc.dart + auth_state.dart + auth_event.dart
  *
  * 本轮迁移：社交登录改由 NextAuth 处理（`@/lib/auth/nextauth`），状态机仅保留
- * 邮箱注册/登录 + 通用 reset 事件。社交登录直接 `await nextauth.googleLogin()` 即可。
+ * 邮箱注册/登录 + 通用 reset 事件。社交登录走 `new GoogleLogin().signIn()` /
+ * `new FacebookLogin().signIn()`。
  */
 import { setup, fromPromise, assign } from "xstate";
 
@@ -60,7 +61,7 @@ export type AuthEvent =
       username: string;
       confirmPassword: string;
     }
-  // 社交登录（已迁移到 NextAuth）— 业务层直接 await nextauth.googleLogin() 即可
+  // 社交登录（已迁移到 NextAuth）— 业务层走 GoogleLogin / FacebookLogin 类
   | { type: "AuthGoogleLoginSubmitted" }
   | { type: "AuthFacebookLoginSubmitted" }
   | { type: "AuthAppleLoginSubmitted" };
@@ -79,24 +80,15 @@ async function readGuestId(): Promise<string | undefined> {
 // ============================================================
 // Actors（异步服务）
 // ============================================================
-/**
- * 设路由信号 cookie（client 端走 marker API）。
- * fail-soft：失败仅 warn，不阻断登录主流程（业务 token 已落 localStorage）。
- */
-async function setAuthCookieClientSide(): Promise<void> {
-  try {
-    await fetch("/api/auth/marker", { method: "POST" });
-  } catch (e) {
-    console.warn("[auth-machine] failed to set auth cookie", e);
-  }
-}
+// 邮箱登录 actor 仅调 authRepository.emailLogin 拿业务 token。
+// 本轮起不再调 /api/auth/marker 写 cookie（统一迁到 NextAuth session
+// cookie 检测，邮箱登录 proxy 行为在后续轮恢复）。
 
 const emailLoginActor = fromPromise<LoginType, { email: string; password: string }>(
   async ({ input }) => {
     const guestId = await readGuestId();
     const result = await authRepository.emailLogin({ ...input, guestId });
     if (Result.isErr(result)) throw result.error;
-    await setAuthCookieClientSide();
     return "email" as LoginType;
   },
 );
@@ -117,7 +109,6 @@ const emailRegisterThenLoginActor = fromPromise<
     guestId,
   });
   if (Result.isErr(loginResult)) throw loginResult.error;
-  await setAuthCookieClientSide();
   return "email" as LoginType;
 });
 
@@ -166,7 +157,7 @@ export const authMachine = setup({
         },
         AuthEmailLoginSubmitted: "loadingEmailLogin",
         AuthEmailRegisterSubmitted: "loadingEmailRegister",
-        // 社交登录已迁移到 NextAuth，业务层直接 await nextauth.googleLogin() / nextauth.facebookLogin()
+        // 社交登录已迁移到 NextAuth + GoogleLogin / FacebookLogin 类
         // 状态机保留事件以兼容旧调用方（实际不再触发）
         AuthGoogleLoginSubmitted: {},
         AuthFacebookLoginSubmitted: {},