fix(iap): address code review defects in freemium/IAP change

Fixes 9 of 10 review findings (10th requires a manual Play Console
step, no code change):

1. app.dart/banner_anuncio_superior.dart: move the top SafeArea inside
   BannerAnuncioSuperior so it only reserves status-bar height when an
   ad actually renders, restoring edge-to-edge layout for premium and
   free-unloaded users.
2. servicio_anuncios.dart: bound every interstitial await (load,
   presentation, and the injected implementation itself) with
   injectable timeouts so a callback that never fires can no longer
   hang a caller.
3. estado_entitlement.dart/hoja_premium.dart: expose a typed
   resultadoUsuario signal for purchase/restore failures and
   restore-found-nothing, with dedicated localized messages
   (compraError, restauracionSinCompras) across all 13 locales --
   never the raw developer/exception string.
4. main.dart/servicio_consentimiento.dart: add a GDPR/UMP consent flow
   (ConsentInformation/ConsentForm) that gates Mobile Ads SDK init on
   canRequestAds(); premium users never see a consent form; failures
   degrade to no ads instead of crashing or blocking startup.
6. servicio_anuncios.dart: track real ad presentation
   (onAdShowedFullScreenContent) so a failed-to-show interstitial no
   longer consumes a session cap slot.
7. banner_anuncio_superior.dart: add an explicit load-attempted guard
   so repeated didChangeDependencies (e.g. entitlement notifyListeners
   during a purchase) can only ever trigger one banner load attempt.
8. servicio_anuncios.dart: make esPremium a required constructor
   parameter, matching the hardened contract already applied to
   EstadoAlarmas/EstadoGrabacion/EstadoRadio.
9. hoja_premium.dart: add a dedicated premiumActivo localized string
   instead of reusing the equalizer's equalizerActive translation,
   across all 13 locales.

All fixes implemented RED-first (failing test before production
code). Full suite: 1261 passed, 2 pre-existing skips, 0 failures.
flutter analyze: 5 pre-existing issues only, 0 new.

[version set]

lib/servicios/servicio_anuncios.dart

@@ -18,12 +18,10 @@ const _interstitialAdUnitIdReal = 'ca-app-pub-6038935671414339/4189478248';
 /// Real id in release builds only; test id everywhere else (debug/profile,
 /// including internal-testing-track builds run via `flutter run --release`
 /// on a personal device — see the "never tap your own ads" note above).
-const bannerAdUnitId = kReleaseMode
-    ? _bannerAdUnitIdReal
-    : bannerAdUnitIdPrueba;
-const interstitialAdUnitId = kReleaseMode
-    ? _interstitialAdUnitIdReal
-    : interstitialAdUnitIdPrueba;
+const bannerAdUnitId =
+    kReleaseMode ? _bannerAdUnitIdReal : bannerAdUnitIdPrueba;
+const interstitialAdUnitId =
+    kReleaseMode ? _interstitialAdUnitIdReal : interstitialAdUnitIdPrueba;
 
 /// Ads port + AdMob adapter (Design "Interfaces / Contracts", ADR-6): owns
 /// the entitlement gate for both surfaces, the interstitial's session
@@ -34,13 +32,16 @@ const interstitialAdUnitId = kReleaseMode
 /// and zero AdMob platform channels (Design Testing Strategy).
 class ServicioAnuncios {
   ServicioAnuncios({
-    bool Function()? esPremium,
+    required bool Function() esPremium,
     DateTime Function()? ahora,
     Future<bool> Function()? mostrarInterstitialImpl,
-  }) : _esPremium = esPremium ?? (() => false),
+    Duration? timeoutIntentoInterstitial,
+  }) : _esPremium = esPremium,
        _ahora = ahora ?? DateTime.now,
        _mostrarInterstitialImpl =
-           mostrarInterstitialImpl ?? _mostrarInterstitialAdMob;
+           mostrarInterstitialImpl ?? _mostrarInterstitialAdMob,
+       _timeoutIntentoInterstitial =
+           timeoutIntentoInterstitial ?? timeoutIntentoInterstitialPorDefecto;
 
   /// Session-scoped cap (ad-display spec "Interstitial Frequency Cap"): at
   /// most 2 interstitials per process lifetime.
@@ -50,9 +51,32 @@ class ServicioAnuncios {
   /// requirement).
   static const separacionMinima = Duration(minutes: 3);
 
+  /// FIX 2 (code review): bounds `InterstitialAd.load`'s callback wait
+  /// inside [_mostrarInterstitialAdMob] so a load callback that never fires
+  /// cannot hang a caller — every call site (`pantalla_alarmas.dart`,
+  /// `pantalla_favoritos.dart`,
+  /// `ajustes/pantalla_ajustes_emisoras_personalizadas.dart`) `await`s
+  /// [intentarInterstitial] before opening its form.
+  static const timeoutCargaInterstitialPorDefecto = Duration(seconds: 5);
+
+  /// FIX 2 (code review): bounds the wait for the ad to actually PRESENT
+  /// (`onAdShowedFullScreenContent`) or fail
+  /// (`onAdFailedToShowFullScreenContent`) after `show()`. This method
+  /// deliberately never waits for the ad to be DISMISSED — the caller is
+  /// not blocked on ad dismissal at all, only on the ad actually rendering.
+  static const timeoutPresentacionInterstitialPorDefecto = Duration(seconds: 5);
+
+  /// FIX 2 (code review): the overall bound applied around the INJECTED
+  /// [_mostrarInterstitialImpl] itself (production default: the sum of the
+  /// two timeouts above, plus headroom) — so ANY implementation, including
+  /// a future bug in an injected fake or a different ad SDK, can never hang
+  /// a caller indefinitely. Injectable so tests can use a short value.
+  static const timeoutIntentoInterstitialPorDefecto = Duration(seconds: 15);
+
   final bool Function() _esPremium;
   final DateTime Function() _ahora;
   final Future<bool> Function() _mostrarInterstitialImpl;
+  final Duration _timeoutIntentoInterstitial;
 
   int _mostrados = 0;
   DateTime? _ultimoMostrado;
@@ -83,7 +107,14 @@ class ServicioAnuncios {
   /// interruptions, not load attempts).
   Future<bool> intentarInterstitial() async {
     if (!_dentroDelCap()) return false;
-    final mostrado = await _mostrarInterstitialImpl();
+    // FIX 2 (code review): bound the injected implementation itself — no
+    // caller may ever await this indefinitely, regardless of what
+    // [_mostrarInterstitialImpl] does internally. A timeout is treated
+    // exactly like "no ad shown": `false`, cap not consumed.
+    final mostrado = await _mostrarInterstitialImpl().timeout(
+      _timeoutIntentoInterstitial,
+      onTimeout: () => false,
+    );
     if (mostrado) {
       _mostrados++;
       _ultimoMostrado = _ahora();
@@ -94,11 +125,20 @@ class ServicioAnuncios {
   static Future<bool> _mostrarInterstitialAdMob() async {
     try {
       final cargaCompleter = Completer<InterstitialAd?>();
+      // FIX 2 (code review): a load callback that never fires used to hang
+      // this await forever. `expiradoCarga` guards a LATE callback that
+      // still arrives after the timeout — the ad is disposed instead of
+      // leaked, and never completes the already-abandoned completer.
+      var expiradoCarga = false;
       await InterstitialAd.load(
         adUnitId: interstitialAdUnitId,
         request: const AdRequest(),
         adLoadCallback: InterstitialAdLoadCallback(
           onAdLoaded: (ad) {
+            if (expiradoCarga) {
+              ad.dispose();
+              return;
+            }
             if (!cargaCompleter.isCompleted) cargaCompleter.complete(ad);
           },
           onAdFailedToLoad: (error) {
@@ -107,23 +147,60 @@ class ServicioAnuncios {
           },
         ),
       );
-      final cargado = await cargaCompleter.future;
+      final InterstitialAd? cargado;
+      try {
+        cargado = await cargaCompleter.future.timeout(
+          timeoutCargaInterstitialPorDefecto,
+        );
+      } on TimeoutException {
+        expiradoCarga = true;
+        return false;
+      }
       if (cargado == null) return false;
 
-      final cierreCompleter = Completer<void>();
+      // FIX 6 (code review): only a genuinely PRESENTED ad may consume the
+      // session cap. `onAdFailedToShowFullScreenContent` used to complete
+      // the same completer as a real dismissal and the method returned
+      // `true` unconditionally — a failed-to-show ad silently burned one of
+      // only 2 session slots.
+      //
+      // FIX 2 (code review): this method no longer waits for the ad to be
+      // DISMISSED at all — only for it to PRESENT or fail to present — and
+      // that wait is itself bounded, so a `fullScreenContentCallback` that
+      // never fires cannot hang the caller either. `expiradoPresentacion`
+      // guards a late callback the same way `expiradoCarga` does above.
+      var expiradoPresentacion = false;
+      final presentacionCompleter = Completer<bool>();
       cargado.fullScreenContentCallback = FullScreenContentCallback(
+        onAdShowedFullScreenContent: (ad) {
+          if (!presentacionCompleter.isCompleted) {
+            presentacionCompleter.complete(true);
+          }
+        },
         onAdDismissedFullScreenContent: (ad) {
           ad.dispose();
-          if (!cierreCompleter.isCompleted) cierreCompleter.complete();
         },
         onAdFailedToShowFullScreenContent: (ad, error) {
+          if (expiradoPresentacion) {
+            ad.dispose();
+            return;
+          }
           ad.dispose();
-          if (!cierreCompleter.isCompleted) cierreCompleter.complete();
+          if (!presentacionCompleter.isCompleted) {
+            presentacionCompleter.complete(false);
+          }
         },
       );
       await cargado.show();
-      await cierreCompleter.future;
-      return true;
+      try {
+        return await presentacionCompleter.future.timeout(
+          timeoutPresentacionInterstitialPorDefecto,
+        );
+      } on TimeoutException {
+        expiradoPresentacion = true;
+        await cargado.dispose();
+        return false;
+      }
     } catch (e) {
       debugPrint('[PluriWave][anuncios] interstitial ERROR $e');
       return false;

lib/servicios/servicio_consentimiento.dart

@@ -0,0 +1,106 @@
+import 'dart:async';
+
+import 'package:flutter/foundation.dart' show debugPrint;
+import 'package:google_mobile_ads/google_mobile_ads.dart';
+
+/// GDPR/UMP consent I/O abstraction (FIX 4, code review): every other file
+/// depends on this port, never on the `google_mobile_ads` UMP classes
+/// (`ConsentInformation`, `ConsentForm`) directly — matches
+/// `PuertoCompras`'s injection shape, and keeps this testable with zero
+/// AdMob/UMP platform channels in unit tests.
+abstract class PuertoConsentimiento {
+  /// Requests consent info, loads-and-shows the consent form if required,
+  /// and resolves whether ads may be requested afterwards
+  /// (`ConsentInformation.canRequestAds()`). Implementations must NEVER
+  /// throw — any underlying failure degrades to `false` (no ads served),
+  /// never crashes or blocks the caller.
+  Future<bool> resolver();
+}
+
+/// The SOLE UMP call site (FIX 4) — every other file depends on
+/// [PuertoConsentimiento] instead.
+class ServicioConsentimientoUmp implements PuertoConsentimiento {
+  ServicioConsentimientoUmp({
+    ConsentRequestParameters? parametros,
+    Duration? timeoutActualizacion,
+  }) : _parametros = parametros ?? ConsentRequestParameters(),
+       _timeoutActualizacion =
+           timeoutActualizacion ?? const Duration(seconds: 10);
+
+  final ConsentRequestParameters _parametros;
+  final Duration _timeoutActualizacion;
+
+  @override
+  Future<bool> resolver() async {
+    try {
+      // 1. Request an up-to-date consent status. FIX 2's lesson applies
+      // here too: bound the callback-based wait so a callback that never
+      // fires cannot hang startup.
+      final actualizacionCompleter = Completer<void>();
+      ConsentInformation.instance.requestConsentInfoUpdate(
+        _parametros,
+        () {
+          if (!actualizacionCompleter.isCompleted) {
+            actualizacionCompleter.complete();
+          }
+        },
+        (error) {
+          debugPrint(
+            '[PluriWave][consentimiento] requestConsentInfoUpdate ERROR '
+            '${error.message}',
+          );
+          if (!actualizacionCompleter.isCompleted) {
+            actualizacionCompleter.complete();
+          }
+        },
+      );
+      await actualizacionCompleter.future.timeout(
+        _timeoutActualizacion,
+        onTimeout: () {},
+      );
+
+      // 2. Load-and-show the consent form ONLY IF the UMP SDK itself
+      // determines it is required (EEA/UK traffic, no prior valid
+      // consent) — this single call is a no-op everywhere else.
+      await ConsentForm.loadAndShowConsentFormIfRequired((formError) {
+        if (formError != null) {
+          debugPrint(
+            '[PluriWave][consentimiento] '
+            'loadAndShowConsentFormIfRequired ERROR ${formError.message}',
+          );
+        }
+      });
+
+      // 3. The only gate that matters for the caller: may ads be
+      // requested at all right now?
+      return await ConsentInformation.instance.canRequestAds();
+    } catch (e) {
+      debugPrint('[PluriWave][consentimiento] ERROR $e');
+      return false;
+    }
+  }
+}
+
+/// Orchestrates the whole gate (FIX 4): premium users NEVER see a consent
+/// form at all — they get zero ads regardless of consent — so
+/// [PuertoConsentimiento] is never even touched for them. Free-tier users
+/// get the real flow, with any failure degrading silently to "ads not
+/// allowed" rather than crashing or blocking `main()`.
+Future<bool> resolverConsentimientoAnuncios({
+  required bool esPremium,
+  required PuertoConsentimiento consentimiento,
+}) async {
+  if (esPremium) return false;
+  try {
+    return await consentimiento.resolver();
+  } catch (e) {
+    // Defense in depth: [PuertoConsentimiento.resolver] is documented to
+    // never throw, but a caller-provided implementation (fake or future
+    // adapter) failing to honor that contract still may not crash or block
+    // `main()`.
+    debugPrint(
+      '[PluriWave][consentimiento] resolverConsentimientoAnuncios ERROR $e',
+    );
+    return false;
+  }
+}