feat(flutter/auth): server URL screen + auth provider + secure storage

AuthController is an AsyncNotifier holding the currently-logged-in
User. server_url, session_token, current_user all live in
flutter_secure_storage. ServerUrlScreen probes /healthz before saving
the URL so we don't store a bogus base.

flutter_client/lib/api/endpoints/health.dart

@@ -0,0 +1,14 @@
+import 'package:dio/dio.dart';
+
+class HealthApi {
+  HealthApi(this._dio);
+  final Dio _dio;
+
+  /// Returns {status, min_client_version}. Hits the unauthenticated
+  /// `/healthz` endpoint at the configured base URL.
+  Future<Map<String, String>> check() async {
+    final r = await _dio.get<Map<String, dynamic>>('/healthz');
+    return (r.data ?? const <String, dynamic>{})
+        .map((k, v) => MapEntry(k, v.toString()));
+  }
+}