fix(android): share public legal URLs with cloud builds

mobile-uni/tests/app-packaging.test.mjs

@@ -137,6 +137,20 @@ test('正式法务地址必须使用不同的公网 HTTPS 页面', () => {
   ));
 });
 
+test('登录页公网法务地址由版本化公共环境配置供 npm 与 HBuilderX 共用', async () => {
+  const [publicEnv, configureScript, verifier] = await Promise.all([
+    readFile(new URL('../.env', import.meta.url), 'utf8'),
+    readFile(new URL('../scripts/configure-android-privacy.mjs', import.meta.url), 'utf8'),
+    readFile(new URL('../scripts/verify-app-assets.mjs', import.meta.url), 'utf8')
+  ]);
+
+  assert.match(publicEnv, /^VITE_APP_TERMS_URL=https:\/\/peilian\.njzhmj\.top\/legal\/terms\.html$/m);
+  assert.match(publicEnv, /^VITE_APP_PRIVACY_URL=https:\/\/peilian\.njzhmj\.top\/legal\/privacy\.html$/m);
+  assert.doesNotMatch(publicEnv, /(?:TOKEN|SECRET|PASSWORD|KEY)=/i);
+  assert.match(configureScript, /loadEnv\(process\.env\.NODE_ENV \|\| 'production', projectRoot, 'VITE_'\)/);
+  assert.match(verifier, /loadEnv\(process\.env\.NODE_ENV \|\| 'production', projectRoot, 'VITE_'\)/);
+});
+
 test('Android 原生隐私配置明确关闭弹窗，法务地址仍须通过登录页构建校验', async () => {
   const template = await readFile(new URL('../androidPrivacy.json.example', import.meta.url), 'utf8');
   const rendered = renderAndroidPrivacy(
@@ -201,6 +215,8 @@ test('APK 门禁区分自定义调试基座与内置业务资源的测试包', a
   assert.match(verifier, /Packaged login flow is missing the expected service agreement URL/);
   assert.match(verifier, /Packaged login flow is missing the expected privacy policy URL/);
   assert.match(verifier, /Packaged login flow is missing the unchecked-consent failure message/);
+  assert.match(verifier, /\$legalAppServiceFiles\[0\]\.FullName/);
+  assert.doesNotMatch(verifier, /[^\x00-\x7F]/, 'Windows PowerShell 5.1 脚本必须保持纯 ASCII');
   assert.match(verifier, /dist\\build\\app\\app-service\.js/);
   assert.match(verifier, /dist\\build\\app-plus\\app-service\.js/);
   assert.match(verifier, /fixed test SMS code/);