feat(flutter): in-app update banner + Android install intent (#397 phase 2)

Closes the operator-facing half of #397. Soft banner mounts at the
top of the shell when the server has a newer APK bundled at
/api/client/version; tap Install → APK downloads to cache → Android
PackageInstaller intent fires → user taps Install in the system
dialog → app restarts on the new version.

### Dart side

- lib/update/update_info.dart — wire shape for /api/client/version
- lib/update/client_update_provider.dart — Riverpod AsyncNotifier
  polling on app start + every 24h. Compares semver via pub_semver
  with non-semver string-equality fallback. Server 404 = "no update
  channel" = silent. Companion shouldShowUpdateBannerProvider gates
  on a per-version dismissed-set (in-memory; resets on restart).
- lib/update/installer.dart — UpdateInstaller wraps dio.download +
  the MethodChannel call to MainActivity.kt.
- lib/update/update_banner.dart — Material banner with idle /
  downloading (with progress) / error stages. Mounted in
  _ShellWithPlayerBar above the route content; SizedBox.shrink()
  when no update available so non-shell routes (login, server-url)
  see no banner anyway.
- isVersionNewer() extracted as a pure function and tested across
  semver, prerelease ordering, leading-v normalization, and
  non-semver fallback (date-tag style).

### Android side

- AndroidManifest.xml — REQUEST_INSTALL_PACKAGES permission;
  FileProvider with authorities ${applicationId}.fileprovider.
- res/xml/file_paths.xml — exposes the cache directory so the
  downloaded APK can be served via content:// URI (file:// is
  blocked since Android 7).
- MainActivity.kt — MethodChannel handler builds the FileProvider
  URI and fires Intent.ACTION_VIEW with FLAG_GRANT_READ_URI_PERMISSION
  so the system installer can read across the process boundary.

Phase 3 (CI sequencing — bake APK + version file into /app/client/
during release.yml's tag flow) is the remaining piece. Without it
the server returns 404 from /api/client/version and the banner
silently does nothing — graceful degradation, but no actual updates.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

flutter_client/lib/update/client_update_provider.dart

@@ -0,0 +1,102 @@
+import 'dart:async';
+
+import 'package:dio/dio.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:package_info_plus/package_info_plus.dart';
+import 'package:pub_semver/pub_semver.dart';
+
+import '../library/library_providers.dart' show dioProvider;
+import 'installer.dart';
+import 'update_info.dart';
+
+/// Tracks the bundled-server APK version vs. the installed app version.
+/// Polls /api/client/version on startup + every 24h. Returns null when
+/// no update is available (or the channel is unreachable / disabled).
+///
+/// Server returns 404 when no APK is bundled (dev environments, pre-CI
+/// images) — we treat that as "no update channel" and stay silent.
+class ClientUpdateController extends AsyncNotifier<UpdateInfo?> {
+  static const Duration _pollInterval = Duration(hours: 24);
+
+  Timer? _pollTimer;
+
+  @override
+  Future<UpdateInfo?> build() async {
+    ref.onDispose(() {
+      _pollTimer?.cancel();
+      _pollTimer = null;
+    });
+    _pollTimer ??= Timer.periodic(_pollInterval, (_) => ref.invalidateSelf());
+    return _check();
+  }
+
+  Future<UpdateInfo?> _check() async {
+    final dio = await ref.read(dioProvider.future);
+    final Response<Map<String, dynamic>> r;
+    try {
+      r = await dio.get<Map<String, dynamic>>('/api/client/version');
+    } on DioException catch (e) {
+      // 404 = no APK bundled; any other error = treat as silent.
+      if (e.response?.statusCode == 404) return null;
+      return null;
+    }
+    if (r.data == null) return null;
+
+    final info = UpdateInfo.fromJson(r.data!);
+    final installed = (await PackageInfo.fromPlatform()).version;
+    if (!isVersionNewer(info.version, installed)) return null;
+    return info;
+  }
+}
+
+/// True when `serverVersion` is strictly newer than `installedVersion`.
+/// Both strings are normalized (leading 'v' stripped) and parsed as
+/// semver. On parse failure, falls back to string inequality (treats
+/// any difference as "newer" — operator can dismiss if wrong).
+///
+/// Exposed for testing; the polling logic in ClientUpdateController
+/// is the only production caller.
+bool isVersionNewer(String serverVersion, String installedVersion) {
+  final svr = serverVersion.replaceFirst(RegExp(r'^v'), '');
+  final ins = installedVersion.replaceFirst(RegExp(r'^v'), '');
+  try {
+    return Version.parse(svr) > Version.parse(ins);
+  } catch (_) {
+    return svr != ins;
+  }
+}
+
+final clientUpdateProvider =
+    AsyncNotifierProvider<ClientUpdateController, UpdateInfo?>(
+        ClientUpdateController.new);
+
+/// In-memory dismissed-versions set. Keyed by version string so a
+/// later release's banner re-appears even if the operator dismissed
+/// the previous one. Not persisted — restart re-shows the banner,
+/// which is acceptable nudging for v1.
+final _dismissedVersionsProvider = StateProvider<Set<String>>((_) => <String>{});
+
+/// True when the update banner should render: an UpdateInfo is
+/// available AND the operator hasn't dismissed this specific version.
+final shouldShowUpdateBannerProvider = Provider<UpdateInfo?>((ref) {
+  final info = ref.watch(clientUpdateProvider).value;
+  if (info == null) return null;
+  final dismissed = ref.watch(_dismissedVersionsProvider);
+  if (dismissed.contains(info.version)) return null;
+  return info;
+});
+
+/// Dismiss controller: marks the given version as dismissed so the
+/// banner stops showing for this session.
+final dismissUpdateProvider = Provider<void Function(String)>((ref) {
+  return (version) {
+    ref.read(_dismissedVersionsProvider.notifier).update((s) => {...s, version});
+  };
+});
+
+/// Installer provider — depends on dio so the install download uses
+/// the same authenticated client (though /api/client/apk is unauthed,
+/// reusing dio keeps configuration consistent).
+final updateInstallerProvider = FutureProvider<UpdateInstaller>((ref) async {
+  return UpdateInstaller(await ref.watch(dioProvider.future));
+});