feat(flutter/admin): requests screen with approve/reject

AdminRequestsScreen renders rows from adminRequestsProvider, joining
requester user_id → username via adminUsersProvider for display
(falls back to UUID prefix when the users list hasn't loaded yet).
Approve fires immediately; Reject confirms via dialog. Both are
optimistic with rollback in the controller.

Adds AdminUsersController build-only (the read side) so the row join
works; mutation methods land in Slice 3 alongside the Users screen.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

flutter_client/lib/admin/admin_providers.dart

@@ -6,6 +6,7 @@ import '../api/endpoints/admin_requests.dart';
 import '../api/endpoints/admin_users.dart';
 import '../library/library_providers.dart' show dioProvider;
 import '../models/admin_request.dart';
+import '../models/admin_user.dart';
 
 final adminRequestsApiProvider = FutureProvider<AdminRequestsApi>((ref) async {
   return AdminRequestsApi(await ref.watch(dioProvider.future));
@@ -89,3 +90,19 @@ class AdminRequestsController extends AsyncNotifier<List<AdminRequest>> {
 final adminRequestsProvider =
     AsyncNotifierProvider<AdminRequestsController, List<AdminRequest>>(
         AdminRequestsController.new);
+
+/// Read side defined here so the Requests screen can join requester
+/// UUID → username for display. Mutation methods (setAdmin,
+/// setAutoApprove, resetPassword, delete) are appended in Slice 3
+/// alongside the Users screen.
+class AdminUsersController extends AsyncNotifier<List<AdminUser>> {
+  @override
+  Future<List<AdminUser>> build() async {
+    final api = await ref.watch(adminUsersApiProvider.future);
+    return api.list();
+  }
+}
+
+final adminUsersProvider =
+    AsyncNotifierProvider<AdminUsersController, List<AdminUser>>(
+        AdminUsersController.new);

flutter_client/lib/admin/admin_requests_screen.dart

@@ -0,0 +1,71 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+
+import '../models/admin_user.dart';
+import '../shared/widgets/main_app_bar_actions.dart';
+import '../theme/theme_extension.dart';
+import 'admin_providers.dart';
+import 'widgets/admin_request_row.dart';
+
+class AdminRequestsScreen extends ConsumerWidget {
+  const AdminRequestsScreen({super.key});
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    final fs = Theme.of(context).extension<FabledSwordTheme>()!;
+    final requests = ref.watch(adminRequestsProvider);
+    // Best-effort lookup for requester usernames. If the users provider
+    // hasn't loaded yet, valueOrNull is null and rows fall back to the
+    // UUID prefix; no blocking spinner.
+    final users = ref.watch(adminUsersProvider).valueOrNull ?? const <AdminUser>[];
+    final usersById = {for (final u in users) u.id: u};
+
+    return Scaffold(
+      backgroundColor: fs.obsidian,
+      appBar: AppBar(
+        backgroundColor: fs.obsidian,
+        elevation: 0,
+        title: Text('Requests', style: TextStyle(color: fs.parchment)),
+        actions: const [MainAppBarActions(currentRoute: '/admin/requests')],
+      ),
+      body: SafeArea(
+        child: requests.when(
+          loading: () => const Center(child: CircularProgressIndicator()),
+          error: (e, _) =>
+              Center(child: Text('$e', style: TextStyle(color: fs.error))),
+          data: (rows) {
+            if (rows.isEmpty) {
+              return Center(
+                child: Text('No pending requests.',
+                    style: TextStyle(color: fs.ash)),
+              );
+            }
+            final notifier = ref.read(adminRequestsProvider.notifier);
+            return RefreshIndicator(
+              onRefresh: () async =>
+                  ref.refresh(adminRequestsProvider.future),
+              child: ListView.builder(
+                itemCount: rows.length,
+                itemBuilder: (_, i) {
+                  final req = rows[i];
+                  final user = usersById[req.userId];
+                  final display = user?.username ??
+                      (req.userId.length >= 8
+                          ? req.userId.substring(0, 8)
+                          : req.userId);
+                  return AdminRequestRow(
+                    key: Key('admin_request_row_${req.id}'),
+                    request: req,
+                    requesterDisplay: display,
+                    onApprove: () => notifier.approve(req.id),
+                    onReject: () => notifier.reject(req.id),
+                  );
+                },
+              ),
+            );
+          },
+        ),
+      ),
+    );
+  }
+}

flutter_client/lib/admin/widgets/admin_request_row.dart

@@ -0,0 +1,75 @@
+import 'package:flutter/material.dart';
+
+import '../../models/admin_request.dart';
+import '../../theme/theme_extension.dart';
+
+class AdminRequestRow extends StatelessWidget {
+  const AdminRequestRow({
+    super.key,
+    required this.request,
+    required this.requesterDisplay,
+    required this.onApprove,
+    required this.onReject,
+  });
+
+  final AdminRequest request;
+
+  /// Pre-resolved username (or UUID-prefix fallback) for the requester.
+  final String requesterDisplay;
+
+  final VoidCallback onApprove;
+  final VoidCallback onReject;
+
+  @override
+  Widget build(BuildContext context) {
+    final fs = Theme.of(context).extension<FabledSwordTheme>()!;
+    final subtitle =
+        '${request.kind} · ${request.artistName} · requested by $requesterDisplay';
+    return ListTile(
+      title: Text(
+        request.displayName,
+        style: TextStyle(
+          color: fs.parchment,
+          fontFamily: 'Fraunces',
+          fontSize: 16,
+        ),
+      ),
+      subtitle: Text(subtitle, style: TextStyle(color: fs.ash)),
+      trailing: Row(
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          TextButton(
+            onPressed: onApprove,
+            style: TextButton.styleFrom(foregroundColor: fs.moss),
+            child: const Text('Approve'),
+          ),
+          TextButton(
+            onPressed: () async {
+              final ok = await showDialog<bool>(
+                context: context,
+                builder: (ctx) => AlertDialog(
+                  title: const Text('Reject request?'),
+                  content: Text('Reject "${request.displayName}"?'),
+                  actions: [
+                    TextButton(
+                      onPressed: () => Navigator.pop(ctx, false),
+                      child: const Text('Cancel'),
+                    ),
+                    TextButton(
+                      onPressed: () => Navigator.pop(ctx, true),
+                      style: TextButton.styleFrom(foregroundColor: fs.oxblood),
+                      child: const Text('Reject'),
+                    ),
+                  ],
+                ),
+              );
+              if (ok == true) onReject();
+            },
+            style: TextButton.styleFrom(foregroundColor: fs.oxblood),
+            child: const Text('Reject'),
+          ),
+        ],
+      ),
+    );
+  }
+}