chore: upgrade to riverpod 3.x and freezed 3.x

- Upgrade flutter_riverpod to 3.1.0, riverpod_annotation to 4.0.0
- Upgrade freezed to 3.2.3, freezed_annotation to 3.1.0
- Migrate freezed classes to use sealed keyword (freezed 3.x)
- Update provider naming (*NotifierProvider → *Provider)
- Add legacy.dart import for StateNotifierProvider compatibility
- Fix valueOrNull → value for AsyncValue
- Remove unused imports and fields
- Add sync from Authentik button to users/groups pages
- Suppress invalid_annotation_target warning in analysis_options

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

lib/features/control_room/containers/data/datasources/containers_datasource.dart

@@ -1,5 +1,4 @@
 import 'package:dio/dio.dart';
-import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 import 'package:tatlock_ui/core/api/api_client.dart';
 import 'package:tatlock_ui/features/control_room/containers/data/models/container_model.dart';

lib/features/control_room/containers/data/models/container_model.dart

@@ -6,7 +6,7 @@ part 'container_model.g.dart';
 
 /// Container data model for API serialization.
 @freezed
-class ContainerModel with _$ContainerModel {
+sealed class ContainerModel with _$ContainerModel {
   const factory ContainerModel({
     @JsonKey(name: 'Id') required String id,
     @JsonKey(name: 'Names') required List<String> names,
@@ -68,7 +68,7 @@ class ContainerModel with _$ContainerModel {
 
 /// Port mapping model.
 @freezed
-class PortModel with _$PortModel {
+sealed class PortModel with _$PortModel {
   const factory PortModel({
     @JsonKey(name: 'IP') String? ip,
     @JsonKey(name: 'PrivatePort') required int privatePort,
@@ -93,7 +93,7 @@ class PortModel with _$PortModel {
 
 /// Mount model.
 @freezed
-class MountModel with _$MountModel {
+sealed class MountModel with _$MountModel {
   const factory MountModel({
     @JsonKey(name: 'Type') required String type,
     @JsonKey(name: 'Source') required String source,
@@ -119,7 +119,7 @@ class MountModel with _$MountModel {
 
 /// Network settings model.
 @freezed
-class NetworkSettingsModel with _$NetworkSettingsModel {
+sealed class NetworkSettingsModel with _$NetworkSettingsModel {
   const factory NetworkSettingsModel({
     @JsonKey(name: 'Networks') @Default({}) Map<String, dynamic> networks,
   }) = _NetworkSettingsModel;

lib/features/control_room/containers/data/repositories/container_repository_impl.dart

@@ -77,7 +77,7 @@ class ContainerRepositoryImpl implements ContainerRepository {
 
 /// Provides the container repository.
 @riverpod
-ContainerRepository containerRepository(ContainerRepositoryRef ref) {
+ContainerRepository containerRepository(Ref ref) {
   final datasource = ref.watch(containersDatasourceProvider);
   return ContainerRepositoryImpl(datasource);
 }

lib/features/control_room/containers/domain/entities/container.dart

@@ -4,7 +4,7 @@ part 'container.freezed.dart';
 
 /// Docker container entity.
 @freezed
-class Container with _$Container {
+sealed class Container with _$Container {
   const factory Container({
     /// Container ID (short form).
     required String id,
@@ -122,7 +122,7 @@ enum ContainerState {
 
 /// Port mapping configuration.
 @freezed
-class PortMapping with _$PortMapping {
+sealed class PortMapping with _$PortMapping {
   const factory PortMapping({
     /// Host IP (usually 0.0.0.0).
     String? hostIp,
@@ -149,7 +149,7 @@ class PortMapping with _$PortMapping {
 
 /// Volume mount configuration.
 @freezed
-class VolumeMount with _$VolumeMount {
+sealed class VolumeMount with _$VolumeMount {
   const factory VolumeMount({
     /// Mount type (bind, volume, tmpfs).
     required String type,

lib/features/control_room/containers/presentation/providers/containers_provider.dart

@@ -7,14 +7,14 @@ part 'containers_provider.g.dart';
 
 /// Provides all containers.
 @riverpod
-Future<List<Container>> allContainers(AllContainersRef ref) async {
+Future<List<Container>> allContainers(Ref ref) async {
   final repository = ref.watch(containerRepositoryProvider);
   return repository.getContainers();
 }
 
 /// Provides containers filtered by the selected stack.
 @riverpod
-Future<List<Container>> containers(ContainersRef ref) async {
+Future<List<Container>> containers(Ref ref) async {
   final repository = ref.watch(containerRepositoryProvider);
   final selectedStack = ref.watch(selectedStackProvider);
 
@@ -27,7 +27,7 @@ Future<List<Container>> containers(ContainersRef ref) async {
 
 /// Provides a single container by ID.
 @riverpod
-Future<Container> container(ContainerRef ref, String id) async {
+Future<Container> container(Ref ref, String id) async {
   final repository = ref.watch(containerRepositoryProvider);
   return repository.getContainer(id);
 }
@@ -82,7 +82,7 @@ class ContainerActions extends _$ContainerActions {
 /// Container logs provider.
 @riverpod
 Future<String> containerLogs(
-  ContainerLogsRef ref,
+  Ref ref,
   String id, {
   int? tail = 100,
 }) async {

lib/features/control_room/containers/presentation/widgets/container_logs_viewer.dart

@@ -22,7 +22,6 @@ class ContainerLogsViewer extends ConsumerStatefulWidget {
 class _ContainerLogsViewerState extends ConsumerState<ContainerLogsViewer> {
   final _scrollController = ScrollController();
   int _tailLines = 100;
-  bool _autoScroll = true;
 
   @override
   void dispose() {

lib/features/control_room/npm/data/datasources/proxy_hosts_datasource.dart

@@ -1,5 +1,4 @@
 import 'package:dio/dio.dart';
-import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 import 'package:tatlock_ui/core/api/api_client.dart';
 import 'package:tatlock_ui/features/control_room/npm/data/models/proxy_host_model.dart';

lib/features/control_room/npm/data/models/proxy_host_model.dart

@@ -43,7 +43,7 @@ class IntOrBoolConverter implements JsonConverter<int, dynamic> {
 ///
 /// Maps to the NPM API response format via Core API.
 @freezed
-class ProxyHostModel with _$ProxyHostModel {
+sealed class ProxyHostModel with _$ProxyHostModel {
   const factory ProxyHostModel({
     required int id,
     @JsonKey(name: 'domain_names') required List<String> domainNames,
@@ -96,7 +96,7 @@ class ProxyHostModel with _$ProxyHostModel {
 
 /// Proxy location model.
 @freezed
-class ProxyLocationModel with _$ProxyLocationModel {
+sealed class ProxyLocationModel with _$ProxyLocationModel {
   const factory ProxyLocationModel({
     required String path,
     @JsonKey(name: 'forward_scheme') required String forwardScheme,
@@ -123,7 +123,7 @@ class ProxyLocationModel with _$ProxyLocationModel {
 ///
 /// This is a simpler model used for listing domains.
 @freezed
-class DomainInfoModel with _$DomainInfoModel {
+sealed class DomainInfoModel with _$DomainInfoModel {
   const factory DomainInfoModel({
     required String domain,
     required String service,

lib/features/control_room/npm/domain/entities/proxy_host.dart

@@ -4,7 +4,7 @@ part 'proxy_host.freezed.dart';
 
 /// NPM proxy host entity representing a domain configuration.
 @freezed
-class ProxyHost with _$ProxyHost {
+sealed class ProxyHost with _$ProxyHost {
   const factory ProxyHost({
     /// Proxy host ID.
     required int id,
@@ -76,7 +76,7 @@ class ProxyHost with _$ProxyHost {
 
 /// Proxy location for advanced routing.
 @freezed
-class ProxyLocation with _$ProxyLocation {
+sealed class ProxyLocation with _$ProxyLocation {
   const factory ProxyLocation({
     /// Location path.
     required String path,

lib/features/control_room/npm/presentation/pages/proxy_host_page.dart

@@ -101,7 +101,7 @@ class _ProxyHostPageState extends ConsumerState<ProxyHostPage>
       child: EntityAsyncContent<ProxyHost>(
         isLoading: proxyHostAsync.isLoading,
         error: proxyHostAsync.error,
-        data: proxyHostAsync.valueOrNull,
+        data: proxyHostAsync.value,
         onRetry: () => ref.invalidate(proxyHostProvider(widget.proxyHostId!)),
         builder: (proxyHost) {
           if (isEditing) {
@@ -275,7 +275,7 @@ class _ProxyHostView extends StatelessWidget {
                   shrinkWrap: true,
                   physics: const NeverScrollableScrollPhysics(),
                   itemCount: proxyHost.locations.length,
-                  separatorBuilder: (_, __) => const Divider(height: 1),
+                  separatorBuilder: (_, index) => const Divider(height: 1),
                   itemBuilder: (context, index) {
                     final loc = proxyHost.locations[index];
                     return ListTile(

lib/features/control_room/npm/presentation/providers/proxy_hosts_provider.dart

@@ -1,4 +1,3 @@
-import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 import 'package:tatlock_ui/features/control_room/npm/data/datasources/proxy_hosts_datasource.dart';
 import 'package:tatlock_ui/features/control_room/npm/data/models/proxy_host_model.dart';

lib/features/control_room/stacks/data/datasources/stacks_datasource.dart

@@ -125,7 +125,7 @@ class StacksDatasource {
 
 /// Provides the stacks datasource.
 @riverpod
-StacksDatasource stacksDatasource(StacksDatasourceRef ref) {
+StacksDatasource stacksDatasource(Ref ref) {
   final dio = ref.watch(coreApiClientProvider);
   final containersDatasource = ref.watch(containersDatasourceProvider);
   return StacksDatasource(dio, containersDatasource);

lib/features/control_room/stacks/data/models/stack_model.dart

@@ -6,7 +6,7 @@ part 'stack_model.g.dart';
 
 /// Stack data model for API serialization.
 @freezed
-class StackModel with _$StackModel {
+sealed class StackModel with _$StackModel {
   const factory StackModel({
     required String id,
     required String name,

lib/features/control_room/stacks/data/repositories/stack_repository_impl.dart

@@ -75,7 +75,7 @@ class StackRepositoryImpl implements StackRepository {
 
 /// Provides the stack repository.
 @riverpod
-StackRepository stackRepository(StackRepositoryRef ref) {
+StackRepository stackRepository(Ref ref) {
   final datasource = ref.watch(stacksDatasourceProvider);
   return StackRepositoryImpl(datasource);
 }

lib/features/control_room/stacks/domain/entities/stack.dart

@@ -4,7 +4,7 @@ part 'stack.freezed.dart';
 
 /// Container orchestration stack (Docker Compose stack).
 @freezed
-class Stack with _$Stack {
+sealed class Stack with _$Stack {
   const factory Stack({
     /// Unique stack identifier.
     required String id,

lib/features/control_room/stacks/presentation/providers/stacks_provider.dart

@@ -6,14 +6,14 @@ part 'stacks_provider.g.dart';
 
 /// Provides the list of all stacks.
 @riverpod
-Future<List<Stack>> stacks(StacksRef ref) async {
+Future<List<Stack>> stacks(Ref ref) async {
   final repository = ref.watch(stackRepositoryProvider);
   return repository.getStacks();
 }
 
 /// Provides a single stack by ID.
 @riverpod
-Future<Stack> stack(StackRef ref, String id) async {
+Future<Stack> stack(Ref ref, String id) async {
   final repository = ref.watch(stackRepositoryProvider);
   return repository.getStack(id);
 }
@@ -35,14 +35,14 @@ class SelectedStack extends _$SelectedStack {
 
 /// Provides the YAML content for a stack.
 @riverpod
-Future<String> stackYaml(StackYamlRef ref, String stackId) async {
+Future<String> stackYaml(Ref ref, String stackId) async {
   final repository = ref.watch(stackRepositoryProvider);
   return repository.getStackYaml(stackId);
 }
 
 /// Provides the environment variables for a stack.
 @riverpod
-Future<Map<String, String>> stackEnvVars(StackEnvVarsRef ref, String stackId) async {
+Future<Map<String, String>> stackEnvVars(Ref ref, String stackId) async {
   final repository = ref.watch(stackRepositoryProvider);
   return repository.getStackEnvVars(stackId);
 }

lib/features/security/groups/groups_list_page.dart

@@ -40,6 +40,7 @@ class GroupsListPage extends ConsumerStatefulWidget {
 class _GroupsListPageState extends ConsumerState<GroupsListPage> {
   late final StateNotifierProvider<DataGridController<GroupData>,
       DataGridState<GroupData>> _gridProvider;
+  bool _isSyncing = false;
 
   @override
   void initState() {
@@ -59,6 +60,38 @@ class _GroupsListPageState extends ConsumerState<GroupsListPage> {
     );
   }
 
+  Future<void> _syncFromAuthentik() async {
+    if (_isSyncing) return;
+    setState(() => _isSyncing = true);
+
+    try {
+      final dio = ref.read(coreApiClientProvider);
+      await dio.post<void>('/auth/groups/sync-from-authentik');
+
+      if (!mounted) return;
+      ref.read(_gridProvider.notifier).refresh();
+
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(
+          content: const Text('Groups synced from Authentik'),
+          behavior: SnackBarBehavior.floating,
+          duration: const Duration(seconds: 2),
+        ),
+      );
+    } catch (e) {
+      if (!mounted) return;
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(
+          content: Text('Sync failed: $e'),
+          behavior: SnackBarBehavior.floating,
+          duration: const Duration(seconds: 4),
+        ),
+      );
+    } finally {
+      if (mounted) setState(() => _isSyncing = false);
+    }
+  }
+
   DataGridConfig<GroupData> _buildConfig() {
     return DataGridConfig<GroupData>(
       columns: [
@@ -106,6 +139,18 @@ class _GroupsListPageState extends ConsumerState<GroupsListPage> {
           tooltip: 'Refresh',
           onPressed: () => ref.read(_gridProvider.notifier).refresh(),
         ),
+        const SizedBox(width: 8),
+        FilledButton.icon(
+          onPressed: _isSyncing ? null : _syncFromAuthentik,
+          icon: _isSyncing
+              ? const SizedBox(
+                  width: 16,
+                  height: 16,
+                  child: CircularProgressIndicator(strokeWidth: 2),
+                )
+              : const Icon(Icons.sync),
+          label: const Text('Sync from Authentik'),
+        ),
       ],
     );
   }

lib/features/security/users/users_list_page.dart

@@ -70,6 +70,7 @@ class UsersListPage extends ConsumerStatefulWidget {
 class _UsersListPageState extends ConsumerState<UsersListPage> {
   late final StateNotifierProvider<DataGridController<UserData>,
       DataGridState<UserData>> _gridProvider;
+  bool _isSyncing = false;
 
   @override
   void initState() {
@@ -88,6 +89,38 @@ class _UsersListPageState extends ConsumerState<UsersListPage> {
     );
   }
 
+  Future<void> _syncFromAuthentik() async {
+    if (_isSyncing) return;
+    setState(() => _isSyncing = true);
+
+    try {
+      final dio = ref.read(coreApiClientProvider);
+      await dio.post<void>('/auth/users/sync-from-authentik');
+
+      if (!mounted) return;
+      ref.read(_gridProvider.notifier).refresh();
+
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(
+          content: const Text('Users synced from Authentik'),
+          behavior: SnackBarBehavior.floating,
+          duration: const Duration(seconds: 2),
+        ),
+      );
+    } catch (e) {
+      if (!mounted) return;
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(
+          content: Text('Sync failed: $e'),
+          behavior: SnackBarBehavior.floating,
+          duration: const Duration(seconds: 4),
+        ),
+      );
+    } finally {
+      if (mounted) setState(() => _isSyncing = false);
+    }
+  }
+
   DataGridConfig<UserData> _buildConfig() {
     return DataGridConfig<UserData>(
       columns: [
@@ -131,6 +164,18 @@ class _UsersListPageState extends ConsumerState<UsersListPage> {
           tooltip: 'Refresh',
           onPressed: () => ref.read(_gridProvider.notifier).refresh(),
         ),
+        const SizedBox(width: 8),
+        FilledButton.icon(
+          onPressed: _isSyncing ? null : _syncFromAuthentik,
+          icon: _isSyncing
+              ? const SizedBox(
+                  width: 16,
+                  height: 16,
+                  child: CircularProgressIndicator(strokeWidth: 2),
+                )
+              : const Icon(Icons.sync),
+          label: const Text('Sync from Authentik'),
+        ),
       ],
     );
   }