feat(flutter/api): admin endpoint clients

Four small Dio-backed API classes mirroring the server's actual
contract (verified against internal/api/admin_*.go):

- Requests/Quarantine return flat lists; Users/Invites are enveloped
  ({"users": [...]}, {"invites": [...]}) and unwrap here
- setAutoApprove sends {auto_approve: bool} — different from the
  response field name auto_approve_requests
- resetPassword takes admin-supplied {password: string}, returns 204
- Invite create takes optional {note: string}; expiry is server-fixed
  at 24h

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

flutter_client/lib/api/endpoints/admin_requests.dart

@@ -0,0 +1,26 @@
+import 'package:dio/dio.dart';
+
+import '../../models/admin_request.dart';
+
+class AdminRequestsApi {
+  AdminRequestsApi(this._dio);
+  final Dio _dio;
+
+  /// GET /api/admin/requests — flat list of pending requests.
+  /// Server defaults to ?status=pending; we don't override.
+  Future<List<AdminRequest>> list() async {
+    final r = await _dio.get<List<dynamic>>('/api/admin/requests');
+    final raw = r.data ?? const [];
+    return raw
+        .map((e) => AdminRequest.fromJson((e as Map).cast<String, dynamic>()))
+        .toList(growable: false);
+  }
+
+  Future<void> approve(String id) async {
+    await _dio.post<void>('/api/admin/requests/$id/approve');
+  }
+
+  Future<void> reject(String id) async {
+    await _dio.post<void>('/api/admin/requests/$id/reject');
+  }
+}