fix(auth): skip Flutter OIDC on web, rely on NPM forward auth

On web, NPM forward auth handles authentication at the proxy level.
By the time the Flutter app loads, the user is already authenticated.
Skip the redundant Flutter OIDC flow that was causing Riverpod
"Ref disposed" errors from conflicting auth state updates.

Mobile still uses Flutter's OIDC flow as before.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,7 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [1.1.1] - 2026-01-04
+## [1.1.2] - 2026-01-04
+
+### Changed
+- **Web auth simplified**: Skip Flutter OIDC on web - NPM forward auth handles it
+  - NPM authenticates at proxy level before app loads
+  - No more redundant OIDC redirect after NPM auth completes
+  - Fixes "Cannot use Ref after disposed" error from conflicting auth flows
+  - Mobile still uses Flutter OIDC flow
 
 ### Added
 - Logout now redirects to Authentik to end SSO session
@@ -15,12 +22,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Uses OIDC end_session_endpoint from discovery document
   - Redirects back to app after Authentik logout completes
 
-### Fixed
-- Fixed Riverpod lifecycle error in OIDC callback page
-  - "Cannot use the Ref of authProvider after it has been disposed"
-  - Store notifier reference before async gap to prevent disposed ref access
-  - Add mounted check at start of callback processing
-
 ## [1.1.0] - 2026-01-04
 
 ### Changed

lib/shared/layouts/app_scaffold.dart

@@ -1,3 +1,4 @@
+import 'package:flutter/foundation.dart' show kIsWeb;
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:go_router/go_router.dart';
@@ -45,6 +46,14 @@ class _AppScaffoldState extends ConsumerState<AppScaffold> {
       return _buildScaffold(context);
     }
 
+    // On web, NPM forward auth handles authentication at the proxy level.
+    // If we reach this point, the user is already authenticated by NPM.
+    // No need for Flutter's OIDC flow - just show the app.
+    if (kIsWeb) {
+      return _buildScaffold(context);
+    }
+
+    // Mobile: Use Flutter's OIDC flow
     final authAsync = ref.watch(authProvider);
 
     return authAsync.when(

pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.1.1+1
+version: 1.1.2+1
 
 environment:
   sdk: ^3.10.4