STUDYU-57 fix(flutter_common): isolate debug storage by environment

[johannesvedder]

Description

Switching STUDYU_ENV while reusing fixed localhost ports caused Flutter web to restore Supabase sessions and participant-local data from the previous environment. The stale credentials produced invalid JWT and refresh-token failures until browser storage was cleared manually.

This change namespaces all SecureStorage keys by STUDYU_ENV in debug builds. .env.dev and .env.local therefore keep separate sessions, participant credentials, selected subjects, caches, and onboarding state. Debug .env and all profile/release builds retain the existing unscoped keys, so deployed participants and Designer users keep their current storage behavior. Supabase fallback URLs within one environment continue sharing the same namespace.

The storage namespace is selected before environment loading, and each operation resolves its key before waiting for the storage lock.

Testing Steps

1. Run the app on port 8080 with --dart-define=STUDYU_ENV=.env.dev and create or restore participant state.
2. Restart it on the same port with .env.local; verify it does not restore the .env.dev session or participant data.
3. Switch back to .env.dev; verify its previous debug state is restored.
4. Repeat the environment switch for Designer on port 8081 and verify no stale refresh-token errors occur.
5. Run cd flutter_common && rtk fvm flutter test.
6. Run scripts/pre-commit-check from the repository root.

PR Checklist

• Formatting passes via scripts/pre-commit-check
• Dart and Flutter analyzers pass via scripts/pre-commit-check
• No visual changes
• Manual app and Designer environment-switch flow verified

[github-actions]

Visit the preview URL for this PR (updated for commit fbdcaad):

• https://studyu-dev-app--pr886-fix-supabase-session-i9n993ik.web.app
• https://studyu-dev-designer--pr886-fix-supabase-session-dta18ij4.web.app

_{(expires Tue, 21 Jul 2026 09:55:25 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: 2149dad49ed83535217e50d5c18c0c8c90da629b}