✨ Add MetaMask login button via Reown AppKit

[javaing]

Summary

• Renders a fixed-position Login with MetaMask button at the bottom of the WebView whenever the user is logged out of 3ook.com (detected via absence of the nuxt-session cookie).
• Tapping it opens Reown AppKit's wallet picker → routes to MetaMask Mobile for personal_sign → posts the signed payload to 3ook.com/api/login → installs the returned nuxt-session cookie → forces a fresh server-side render so SSR picks up the new session.
• After auth, the button hides automatically and the existing identity bridge (web → native) carries on as usual.

Why `/api/login` and not `api.like.co/users/login`

3ook's frontend authenticates against the encrypted Nuxt session cookie (`nuxt-session` on `.3ook.com`), not the raw `likecoin_auth` JWT scoped to `.like.co`. Calling the upstream API directly returns a valid likecoin JWT but the SPA simply ignores it. Going through `3ook.com/api/login` makes the Nuxt server wrap the upstream response in its own sealed session, so the SPA recognizes the login.

The signed message must be a pretty-printed JSON (2-space indent) containing `action: 'authorize'` and the 10-permission list from `stores/account.ts#JWT_PERMISSIONS` byte-for-byte, otherwise the server's signature recovery fails.

Setup

• Adds `@reown/appkit-react-native` + `@reown/appkit-ethers-react-native` + WalletConnect compat + the usual RN polyfill set (`react-native-get-random-values`, `async-storage`, `netinfo`, `react-native-svg`).
• Adds `babel.config.js` with `unstable_transformImportMeta` (required by valtio on Expo SDK 53+).
• Requires `EXPO_PUBLIC_REOWN_PROJECT_ID` at build time (free signup at https://cloud.reown.com — needs the app's bundle/package ID on the allowlist).

Scope

Covers only the existing wallet-registered user path. New users (or email users who haven't linked an EVM wallet) currently get a "register on the website first" error message — account-linking and on-device registration are deliberately out of scope for v1.

Test plan

• Clear app data, open app → email-login modal shows with the MetaMask button pinned at the bottom
• Tap button → Reown modal opens with MetaMask featured first
• Pick MetaMask → MetaMask Mobile opens → user approves connect → returns to our app
• Sign the authorize message in MetaMask → returns to our app
• WebView reloads to a cache-busted URL; SSR sees `nuxt-session` and renders logged-in state
• 書架 tab shows the user's books; 帳戶 tab shows wallet / Plus status / LikeCoin balance
• Existing identity bridge still receives `identifyUser` with `loginMethod: 'metaMask'` (verified end-to-end on Pixel 10 / Android 16)
• iOS smoke test (untested in this branch)

🤖 Generated with Claude Code