feat(auth): implement dual-flow authentication (web + mobile)

Add complete authentication system supporting both web (NPM forward auth)
and mobile (OIDC) authentication flows.

Web flow:
- Check /auth/me on startup to detect NPM forward auth session
- Cookies handled by proxy, no Bearer tokens needed

Mobile flow:
- flutter_appauth for OIDC Authorization Code + PKCE
- POST /auth/sync to get user profile and roles
- Token storage in SharedPreferences

Shared:
- Permission system with Domain/Action enums and Role class
- PermissionGate and AdminGate widgets for UI permission checks
- Route guards redirecting unauthenticated users to login
- Login page with platform-specific messaging

Platform config:
- iOS: CFBundleURLTypes for net.schweitz.tatlock://
- Android: appAuthRedirectScheme, minSdk 23

Docs:
- Added Freezed 3.x sealed class documentation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

pubspec.yaml

@@ -50,6 +50,9 @@ dependencies:
   # Storage
   shared_preferences: ^2.3.3
 
+  # Authentication (OIDC/OAuth2)
+  flutter_appauth: ^8.0.0
+
   # UI
   flex_color_scheme: ^8.1.0
   flutter_adaptive_scaffold: ^0.3.1