feat(controlled): 实现设备激活与安全认证流程

- 添加API客户端、加密存储和provision/token激活逻辑
- WebSocket改用Bearer令牌认证，移除REGISTER请求
- 设备ID改为服务端下发，支持令牌刷新和强制下线处理
- 新增deviceSecret加密存储和accessToken自动刷新
- 更新设备ID获取方式为出厂SN，添加安全存储依赖

webrtc_controller_flutter/lib/webrtc/webrtc_controller.dart

@@ -88,6 +88,9 @@ class WebRtcController {
   static const int streamModeWebRtc = 0;
   static const int streamModeSelfCodec = 1;
 
+  /// 由服务端下发的 TURN 短期凭证覆盖默认 ICE 配置（为空则用 kIceServers）。
+  static List<Map<String, dynamic>>? iceServersOverride;
+
   WebRtcController({
     required this.signaling,
     required this.deviceId,
@@ -100,8 +103,9 @@ class WebRtcController {
   Future<void> initialize() async {
     await renderer.initialize();
 
+    final iceServers = iceServersOverride ?? kIceServers;
     final configuration = {
-      'iceServers': kIceServers,
+      'iceServers': iceServers,
       'sdpSemantics': 'unified-plan',
       'iceCandidatePoolSize': 10,
       // 增强复杂网络下的稳定性，参考 Android 端配置。
@@ -110,7 +114,7 @@ class WebRtcController {
       'tcpCandidatePolicy': 'enabled',
     };
 
-    final iceUrls = (kIceServers)
+    final iceUrls = iceServers
         .map((e) => '${e['username'] != null ? '(${e['username']})' : ''}${e['urls']}')
         .join(', ');
     debugPrint('[WebRtcController] signaling server: ${signaling.serverUrl} | '