feat(client): Flutter app (web target) — Phase 7 start

Single Flutter codebase under client/app/ with web enabled (mobile/desktop
can be added later; lib/ is platform-agnostic). Talks to the NestJS backend
via a thin REST wrapper; API_BASE is a --dart-define (defaults to the local
backend).

Screens:
- Login: Konfi/guest (invite code), local Teamer password login, Teamer
  invite redemption. Token persisted in shared_preferences, restored on
  start; GET /auth/me drives a role-aware home.
- Workshop-Wahl (guests): loads /wahl/guest/overview, ordered pick of up to
  3 workshops, submits to /wahl/:id/teilnehmer.
- Dateien: /files/:kcId list.
- Chat: channel + message list (read-only; WS send is a follow-up).

State: AppState (ChangeNotifier) exposed via an InheritedNotifier
(AppScope) — no third-party state package. flutter analyze clean,
flutter build web --release passes, one widget smoke test.

Also: interim client/web/ HTML placeholder stays as-is (per plan it is
superseded by this Flutter web build).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

client/app/README.md

@@ -0,0 +1,43 @@
+# KC-App client (Flutter)
+
+Single Flutter codebase for the KC-App platform. **Web** is the only target
+enabled so far (`flutter config --enable-web`); Android/iOS/desktop can be
+added later with `flutter create --platforms=...` in this directory — the
+`lib/` code is platform-agnostic.
+
+## Run
+
+```bash
+flutter pub get
+flutter run -d chrome --dart-define=API_BASE=http://localhost:3000/api
+```
+
+`API_BASE` defaults to `http://localhost:3000/api` (the local NestJS
+backend, which also serves the interim plain-HTML client at `/`).
+
+## What's implemented
+
+- **Login** (`lib/screens/login_screen.dart`) — three tabs:
+  - *Konfi / Gast*: KC invite code + first/last name → `POST /auth/guest`.
+  - *Team-Login*: email + password for local Gemeinde Teamer →
+    `POST /auth/team-login`. (Leitungsteam / Verantwortliche use the
+    Authentik Authorization-Code flow, not yet wired into this client.)
+  - *Einladung*: redeem a Teamer invite token → `POST /auth/teamer/register`.
+- The token is stored via `shared_preferences` (localStorage on web) and
+  restored on start; `GET /auth/me` resolves the role for a role-aware home.
+- **Home** (`lib/screens/home_screen.dart`) — identity card + navigation.
+- **Workshop-Wahl** (`lib/screens/wahl_screen.dart`, guests) — loads
+  `GET /wahl/guest/overview`, tap workshops in order (max 3) to set
+  priorities, `POST /wahl/:id/teilnehmer`.
+- **Dateien** (`lib/screens/files_screen.dart`) — `GET /files/:kcId`,
+  filtered server-side by the caller's visibility tier.
+- **Chat** (`lib/screens/chat_screen.dart`) — channel + message list
+  (read-only; sending is a WebSocket path, still to do).
+
+## Architecture
+
+- `lib/api.dart` — `Api` (thin REST wrapper + models) and `AppState`
+  (`ChangeNotifier`: session, login/logout, token persistence).
+- `lib/main.dart` — `AppScope` (an `InheritedNotifier<AppState>`) exposes
+  `AppScope.of(context)`; `_AuthGate` switches Login/Home. No third-party
+  state-management package.