Stabilize auth flow and profile images

app/test/models/auth_models_test.dart

@@ -50,6 +50,54 @@ void main() {
     expect(response.user.tenantSlug, 'hanmac');
   });
 
+  test('PhoneLoginLinkInitResponse parses pending auth response', () {
+    final response = PhoneLoginLinkInitResponse.fromJson({
+      'status': 'pending',
+      'pendingRef': 'pending-ref',
+      'expiresIn': 180,
+      'interval': 3,
+      'resendAfter': 30,
+      'provider': 'Ory (Kratos/Hydra)',
+    });
+
+    expect(response.pendingRef, 'pending-ref');
+    expect(response.interval, 3);
+    expect(response.provider, 'Ory (Kratos/Hydra)');
+  });
+
+  test('PhoneLoginLinkPollResponse parses completed session', () {
+    final response = PhoneLoginLinkPollResponse.fromJson({
+      'status': 'ok',
+      'session': {
+        'status': 'ok',
+        'token': 'baron-sso-session-token',
+        'expiresAt': '2026-07-02T12:00:00Z',
+        'user': {
+          'id': 'user-uuid',
+          'name': 'User One',
+          'phoneNumber': '+821012345678',
+          'tenantId': 'tenant-uuid',
+          'tenantName': 'Hanmac',
+          'tenantSlug': 'hanmac',
+        },
+      },
+    });
+
+    expect(response.session?.token, 'baron-sso-session-token');
+    expect(response.isPending, isFalse);
+  });
+
+  test('PhoneLoginLinkPollResponse detects pending response', () {
+    final response = PhoneLoginLinkPollResponse.fromJson({
+      'status': 'pending',
+      'code': 'authorization_pending',
+      'interval': 5,
+    });
+
+    expect(response.isPending, isTrue);
+    expect(response.interval, 5);
+  });
+
   test('CurrentUser parses permissions and can map to employee', () {
     final user = CurrentUser.fromJson({
       'id': 'user-uuid',