feat(flutter): connection-error banner + 401-clears-session interceptor

ApiClient.buildDio takes on401; the library's dioProvider wires it to
the auth controller's clearSession. The router redirect already handles
navigation away from authed screens once the session goes null.
HomeScreen surfaces the banner on connection_refused with Retry +
Change URL.

flutter_client/lib/library/home_screen.dart

@@ -1,11 +1,14 @@
+import 'package:dio/dio.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:go_router/go_router.dart';
 
+import '../api/errors.dart';
 import '../models/album.dart';
 import '../models/artist.dart';
 import '../models/track.dart';
 import '../player/player_provider.dart';
+import '../shared/widgets/connection_error_banner.dart';
 import '../theme/theme_extension.dart';
 import 'library_providers.dart';
 import 'widgets/album_card.dart';
@@ -23,7 +26,15 @@ class HomeScreen extends ConsumerWidget {
       backgroundColor: fs.obsidian,
       body: SafeArea(
         child: ref.watch(homeProvider).when(
-              error: (e, _) => Center(child: Text('$e', style: TextStyle(color: fs.error))),
+              error: (e, _) {
+                final code = e is DioException ? ApiError.fromDio(e).code : 'unknown';
+                if (code == 'connection_refused') {
+                  return ConnectionErrorBanner(
+                    onRetry: () => ref.refresh(homeProvider),
+                  );
+                }
+                return Center(child: Text('$e', style: TextStyle(color: fs.error)));
+              },
               loading: () => const Center(child: CircularProgressIndicator()),
               data: (h) => RefreshIndicator(
                 onRefresh: () async => ref.refresh(homeProvider.future),

flutter_client/lib/library/library_providers.dart

@@ -25,6 +25,7 @@ final dioProvider = FutureProvider<Dio>((ref) async {
   return ApiClient.buildDio(
     baseUrl: url,
     tokenResolver: () async => storage.read(key: 'session_token'),
+    on401: () async => ref.read(authControllerProvider.notifier).clearSession(),
   );
 });