feat(flutter/api): dio client with Bearer interceptor + ApiError

ApiError.fromDio handles both server envelope shapes: {"error":"code"}
(admin endpoints) and {"error":{"code","message"}} (most others). Same
dual-shape problem the web apiFetch already solves. Token comes from a
resolver function so the auth provider can swap implementations
without touching the client.

ErrorCopy is a lazy singleton over assets/error-copy.json with the
same fallback chain web uses (specific code -> unknown -> hard-coded).

flutter_client/test/api/client_test.dart

@@ -0,0 +1,42 @@
+import 'package:dio/dio.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import 'package:minstrel/api/client.dart';
+
+void main() {
+  test('client attaches Bearer token from token resolver', () async {
+    final d = ApiClient.buildDio(
+      baseUrl: 'http://example/',
+      tokenResolver: () async => 'tok-123',
+    );
+    Map<String, dynamic>? captured;
+    d.interceptors.add(
+      InterceptorsWrapper(onRequest: (opts, h) {
+        captured = Map<String, dynamic>.from(opts.headers);
+        h.reject(DioException(requestOptions: opts, type: DioExceptionType.cancel));
+      }),
+    );
+    try {
+      await d.get<void>('/whatever');
+    } catch (_) {}
+    expect(captured?['Authorization'], 'Bearer tok-123');
+  });
+
+  test('client omits Authorization when resolver returns null', () async {
+    final d = ApiClient.buildDio(
+      baseUrl: 'http://example/',
+      tokenResolver: () async => null,
+    );
+    Map<String, dynamic>? captured;
+    d.interceptors.add(
+      InterceptorsWrapper(onRequest: (opts, h) {
+        captured = Map<String, dynamic>.from(opts.headers);
+        h.reject(DioException(requestOptions: opts, type: DioExceptionType.cancel));
+      }),
+    );
+    try {
+      await d.get<void>('/whatever');
+    } catch (_) {}
+    expect(captured?.containsKey('Authorization'), isFalse);
+  });
+}