feat(flutter/auth): login screen + AuthApi.login posting to /api/auth/login

Login uses a non-authenticated dio (token resolver returns null) since
we don't have one yet. On success, setSession persists token + user
into secure storage and the AuthController state flips, which the
router watches to navigate.

flutter_client/test/auth/login_screen_test.dart

@@ -0,0 +1,19 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import 'package:minstrel/auth/login_screen.dart';
+import 'package:minstrel/theme/theme_data.dart';
+
+void main() {
+  testWidgets('login screen renders both fields and the submit button', (tester) async {
+    await tester.pumpWidget(ProviderScope(
+      child: MaterialApp(
+        theme: buildThemeData(),
+        home: const LoginScreen(),
+      ),
+    ));
+    expect(find.byType(TextField), findsNWidgets(2));
+    expect(find.text('Sign in'), findsNWidgets(2)); // header + button
+  });
+}