feat: Phase 1 foundation - core infrastructure and navigation

Clean Architecture structure:
- core/config - Environment configuration
- core/theme - Material 3 theming with FlexColorScheme
- core/error - Typed exception hierarchy
- core/api - Dio HTTP clients with interceptors
- core/auth - Authentication state management
- routing - go_router with shell navigation
- shared/layouts - Adaptive scaffold

Dependencies added:
- flutter_riverpod, riverpod_annotation, riverpod_generator
- freezed, freezed_annotation, json_serializable
- dio, go_router, shared_preferences
- flex_color_scheme, flutter_adaptive_scaffold

Features:
- Responsive navigation (rail on desktop, bottom on mobile)
- Dashboard placeholder with welcome card
- Theme switching infrastructure
- API client ready for Core API and Tatlock API

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

lib/core/api/api_client.dart

@@ -0,0 +1,55 @@
+import 'package:dio/dio.dart';
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+import '../config/app_config.dart';
+import 'api_interceptors.dart';
+
+part 'api_client.g.dart';
+
+/// Provides the Dio instance for Core API.
+@riverpod
+Dio coreApiClient(CoreApiClientRef ref) {
+  final dio = Dio(
+    BaseOptions(
+      baseUrl: AppConfig.coreApiUrl,
+      connectTimeout: const Duration(seconds: 10),
+      receiveTimeout: const Duration(seconds: 30),
+      headers: {
+        'Content-Type': 'application/json',
+        'Accept': 'application/json',
+      },
+    ),
+  );
+
+  dio.interceptors.addAll([
+    AuthInterceptor(ref),
+    LoggingInterceptor(),
+    ErrorInterceptor(),
+  ]);
+
+  return dio;
+}
+
+/// Provides the Dio instance for Tatlock API.
+@riverpod
+Dio tatlockApiClient(TatlockApiClientRef ref) {
+  final dio = Dio(
+    BaseOptions(
+      baseUrl: AppConfig.tatlockApiUrl,
+      connectTimeout: const Duration(seconds: 10),
+      receiveTimeout: const Duration(minutes: 5), // Longer for LLM responses
+      headers: {
+        'Content-Type': 'application/json',
+        'Accept': 'application/json',
+      },
+    ),
+  );
+
+  dio.interceptors.addAll([
+    AuthInterceptor(ref),
+    LoggingInterceptor(),
+    ErrorInterceptor(),
+  ]);
+
+  return dio;
+}

lib/core/api/api_interceptors.dart

@@ -0,0 +1,137 @@
+import 'dart:developer' as developer;
+
+import 'package:dio/dio.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+
+import '../auth/auth_provider.dart';
+import '../error/app_exception.dart';
+
+/// Adds authentication token to requests.
+class AuthInterceptor extends Interceptor {
+  AuthInterceptor(this._ref);
+
+  final Ref _ref;
+
+  @override
+  void onRequest(RequestOptions options, RequestInterceptorHandler handler) {
+    final authState = _ref.read(authNotifierProvider);
+
+    authState.whenData((auth) {
+      if (auth.isAuthenticated && auth.accessToken != null) {
+        options.headers['Authorization'] = 'Bearer ${auth.accessToken}';
+      }
+    });
+
+    handler.next(options);
+  }
+
+  @override
+  void onError(DioException err, ErrorInterceptorHandler handler) {
+    if (err.response?.statusCode == 401) {
+      // Token expired - trigger re-authentication
+      _ref.read(authNotifierProvider.notifier).signOut();
+    }
+    handler.next(err);
+  }
+}
+
+/// Logs requests and responses in debug mode.
+class LoggingInterceptor extends Interceptor {
+  @override
+  void onRequest(RequestOptions options, RequestInterceptorHandler handler) {
+    developer.log(
+      '→ ${options.method} ${options.uri}',
+      name: 'api',
+    );
+    handler.next(options);
+  }
+
+  @override
+  void onResponse(Response response, ResponseInterceptorHandler handler) {
+    developer.log(
+      '← ${response.statusCode} ${response.requestOptions.uri}',
+      name: 'api',
+    );
+    handler.next(response);
+  }
+
+  @override
+  void onError(DioException err, ErrorInterceptorHandler handler) {
+    developer.log(
+      '✗ ${err.response?.statusCode ?? 'NETWORK'} ${err.requestOptions.uri}: ${err.message}',
+      name: 'api',
+      error: err,
+    );
+    handler.next(err);
+  }
+}
+
+/// Converts Dio errors to AppException types.
+class ErrorInterceptor extends Interceptor {
+  @override
+  void onError(DioException err, ErrorInterceptorHandler handler) {
+    final exception = _mapToAppException(err);
+    handler.reject(
+      DioException(
+        requestOptions: err.requestOptions,
+        response: err.response,
+        type: err.type,
+        error: exception,
+      ),
+    );
+  }
+
+  AppException _mapToAppException(DioException err) {
+    switch (err.type) {
+      case DioExceptionType.connectionTimeout:
+      case DioExceptionType.sendTimeout:
+      case DioExceptionType.receiveTimeout:
+        return NetworkException(
+          message: 'Connection timed out',
+          cause: err,
+        );
+
+      case DioExceptionType.connectionError:
+        return NetworkException(
+          message: 'Unable to connect to server',
+          cause: err,
+        );
+
+      case DioExceptionType.badResponse:
+        final statusCode = err.response?.statusCode ?? 0;
+        final data = err.response?.data;
+
+        String message = 'Request failed';
+        String? code;
+
+        if (data is Map<String, dynamic>) {
+          final error = data['error'];
+          if (error is Map<String, dynamic>) {
+            message = error['message'] as String? ?? message;
+            code = error['code'] as String?;
+          } else if (error is String) {
+            message = error;
+          }
+        }
+
+        return ApiException(
+          message: message,
+          statusCode: statusCode,
+          code: code,
+          cause: err,
+        );
+
+      case DioExceptionType.cancel:
+        return const NetworkException(message: 'Request cancelled');
+
+      case DioExceptionType.badCertificate:
+        return const NetworkException(message: 'Invalid SSL certificate');
+
+      case DioExceptionType.unknown:
+        return NetworkException(
+          message: err.message ?? 'Unknown error',
+          cause: err,
+        );
+    }
+  }
+}