feat(flutter/api): dio client with Bearer interceptor + ApiError

ApiError.fromDio handles both server envelope shapes: {"error":"code"}
(admin endpoints) and {"error":{"code","message"}} (most others). Same
dual-shape problem the web apiFetch already solves. Token comes from a
resolver function so the auth provider can swap implementations
without touching the client.

ErrorCopy is a lazy singleton over assets/error-copy.json with the
same fallback chain web uses (specific code -> unknown -> hard-coded).

flutter_client/test/api/client_test.dart

@@ -0,0 +1,42 @@
+import 'package:dio/dio.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import 'package:minstrel/api/client.dart';
+
+void main() {
+  test('client attaches Bearer token from token resolver', () async {
+    final d = ApiClient.buildDio(
+      baseUrl: 'http://example/',
+      tokenResolver: () async => 'tok-123',
+    );
+    Map<String, dynamic>? captured;
+    d.interceptors.add(
+      InterceptorsWrapper(onRequest: (opts, h) {
+        captured = Map<String, dynamic>.from(opts.headers);
+        h.reject(DioException(requestOptions: opts, type: DioExceptionType.cancel));
+      }),
+    );
+    try {
+      await d.get<void>('/whatever');
+    } catch (_) {}
+    expect(captured?['Authorization'], 'Bearer tok-123');
+  });
+
+  test('client omits Authorization when resolver returns null', () async {
+    final d = ApiClient.buildDio(
+      baseUrl: 'http://example/',
+      tokenResolver: () async => null,
+    );
+    Map<String, dynamic>? captured;
+    d.interceptors.add(
+      InterceptorsWrapper(onRequest: (opts, h) {
+        captured = Map<String, dynamic>.from(opts.headers);
+        h.reject(DioException(requestOptions: opts, type: DioExceptionType.cancel));
+      }),
+    );
+    try {
+      await d.get<void>('/whatever');
+    } catch (_) {}
+    expect(captured?.containsKey('Authorization'), isFalse);
+  });
+}

flutter_client/test/api/errors_test.dart

@@ -0,0 +1,57 @@
+import 'package:dio/dio.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import 'package:minstrel/api/errors.dart';
+
+void main() {
+  RequestOptions opts() => RequestOptions(path: '/x');
+
+  group('ApiError.fromDio', () {
+    test('flat envelope: {error: "code"}', () {
+      final d = DioException(
+        requestOptions: opts(),
+        response: Response(
+          requestOptions: opts(),
+          statusCode: 503,
+          data: {'error': 'lidarr_unreachable'},
+        ),
+      );
+      final e = ApiError.fromDio(d);
+      expect(e.code, 'lidarr_unreachable');
+      expect(e.status, 503);
+    });
+
+    test('nested envelope: {error: {code, message}}', () {
+      final d = DioException(
+        requestOptions: opts(),
+        response: Response(
+          requestOptions: opts(),
+          statusCode: 400,
+          data: {'error': {'code': 'bad_request', 'message': 'invalid JSON body'}},
+        ),
+      );
+      final e = ApiError.fromDio(d);
+      expect(e.code, 'bad_request');
+      expect(e.message, 'invalid JSON body');
+    });
+
+    test('connection refused: code is connection_refused', () {
+      final d = DioException(
+        requestOptions: opts(),
+        type: DioExceptionType.connectionError,
+        error: 'Connection refused',
+      );
+      final e = ApiError.fromDio(d);
+      expect(e.code, 'connection_refused');
+    });
+
+    test('401 with no envelope falls back to unauthenticated', () {
+      final d = DioException(
+        requestOptions: opts(),
+        response: Response(requestOptions: opts(), statusCode: 401),
+      );
+      final e = ApiError.fromDio(d);
+      expect(e.code, 'unauthenticated');
+    });
+  });
+}