chore: upgrade to riverpod 3.x and freezed 3.x

- Upgrade flutter_riverpod to 3.1.0, riverpod_annotation to 4.0.0
- Upgrade freezed to 3.2.3, freezed_annotation to 3.1.0
- Migrate freezed classes to use sealed keyword (freezed 3.x)
- Update provider naming (*NotifierProvider → *Provider)
- Add legacy.dart import for StateNotifierProvider compatibility
- Fix valueOrNull → value for AsyncValue
- Remove unused imports and fields
- Add sync from Authentik button to users/groups pages
- Suppress invalid_annotation_target warning in analysis_options

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

lib/core/api/api_client.dart

@@ -7,7 +7,7 @@ part 'api_client.g.dart';
 
 /// Provides the Dio instance for Core API.
 @riverpod
-Dio coreApiClient(CoreApiClientRef ref) {
+Dio coreApiClient(Ref ref) {
   final dio = Dio(
     BaseOptions(
       baseUrl: AppConfig.coreApiUrl,
@@ -31,7 +31,7 @@ Dio coreApiClient(CoreApiClientRef ref) {
 
 /// Provides the Dio instance for Tatlock API.
 @riverpod
-Dio tatlockApiClient(TatlockApiClientRef ref) {
+Dio tatlockApiClient(Ref ref) {
   final dio = Dio(
     BaseOptions(
       baseUrl: AppConfig.tatlockApiUrl,

lib/core/api/api_interceptors.dart

@@ -22,7 +22,7 @@ class AuthInterceptor extends Interceptor {
       return;
     }
 
-    final authState = _ref.read(authNotifierProvider);
+    final authState = _ref.read(authProvider);
 
     authState.whenData((auth) {
       if (auth.isAuthenticated && auth.accessToken != null) {
@@ -43,7 +43,7 @@ class AuthInterceptor extends Interceptor {
 
     if (err.response?.statusCode == 401) {
       // Token expired - trigger re-authentication
-      _ref.read(authNotifierProvider.notifier).signOut();
+      _ref.read(authProvider.notifier).signOut();
     }
     handler.next(err);
   }