chore: upgrade to riverpod 3.x and freezed 3.x

- Upgrade flutter_riverpod to 3.1.0, riverpod_annotation to 4.0.0
- Upgrade freezed to 3.2.3, freezed_annotation to 3.1.0
- Migrate freezed classes to use sealed keyword (freezed 3.x)
- Update provider naming (*NotifierProvider → *Provider)
- Add legacy.dart import for StateNotifierProvider compatibility
- Fix valueOrNull → value for AsyncValue
- Remove unused imports and fields
- Add sync from Authentik button to users/groups pages
- Suppress invalid_annotation_target warning in analysis_options

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

lib/core/api/api_client.dart

@@ -7,7 +7,7 @@ part 'api_client.g.dart';
 
 /// Provides the Dio instance for Core API.
 @riverpod
-Dio coreApiClient(CoreApiClientRef ref) {
+Dio coreApiClient(Ref ref) {
   final dio = Dio(
     BaseOptions(
       baseUrl: AppConfig.coreApiUrl,
@@ -31,7 +31,7 @@ Dio coreApiClient(CoreApiClientRef ref) {
 
 /// Provides the Dio instance for Tatlock API.
 @riverpod
-Dio tatlockApiClient(TatlockApiClientRef ref) {
+Dio tatlockApiClient(Ref ref) {
   final dio = Dio(
     BaseOptions(
       baseUrl: AppConfig.tatlockApiUrl,