feat(flutter/models): User, ArtistRef, AlbumRef, TrackRef, HomeData

Field names mirror web/src/lib/api/types.ts and the server JSON shape
(internal/api/types.go's HomePayload). Hand-written DTOs per spec
section 10 -- codegen revisits at ~30 models.

Adopts server contract over plan-body mock:
- cover_url (not cover_art_url) for artist/album refs
- duration_sec (not duration_ms) for albums and tracks
- stream_url, disc_number on TrackRef
- sort_name/album_count on ArtistRef; sort_title/year/track_count on AlbumRef

HomeData section keys match server: recently_added_albums,
rediscover_albums, rediscover_artists, most_played_tracks,
last_played_artists.

flutter_client/lib/models/user.dart

@@ -0,0 +1,24 @@
+// Mirrors internal/api/types.go UserView. The /api/* user shape — narrower
+// than dbq.User (no password hash, no api_token, no subsonic_password).
+//
+// `id` is a pgtype.UUID server-side which marshals to a plain string when
+// Valid, so we accept it as String here. `is_admin` is always present in
+// the server response but we tolerate its absence (default false) to keep
+// older fixtures and partial mocks loadable.
+class User {
+  const User({
+    required this.id,
+    required this.username,
+    required this.isAdmin,
+  });
+
+  final String id;
+  final String username;
+  final bool isAdmin;
+
+  factory User.fromJson(Map<String, dynamic> j) => User(
+        id: j['id'] as String,
+        username: j['username'] as String,
+        isAdmin: j['is_admin'] as bool? ?? false,
+      );
+}