feat: implement Iteration 0 foundation (backend + Flutter client)

Backend (Go):
- Project structure with chi router, pgxpool, goose migrations
- JWT auth (access/refresh tokens) with Firebase token verification
- NoopTokenVerifier for local dev without Firebase credentials
- PostgreSQL user repository with atomic profile updates (transactions)
- Mifflin-St Jeor calorie calculation based on profile data
- REST API: POST /auth/login, /auth/refresh, /auth/logout, GET/PUT /profile, GET /health
- Middleware: auth, CORS (localhost wildcard), logging, recovery, request_id
- Unit tests (51 passing) and integration tests (testcontainers)
- Docker Compose setup with postgres healthcheck and graceful shutdown

Flutter client:
- Riverpod state management with GoRouter navigation
- Firebase Auth (email/password + Google sign-in with web popup support)
- Platform-aware API URLs (web/Android/iOS)
- Dio HTTP client with JWT auth interceptor and concurrent refresh handling
- Secure token storage
- Screens: Login, Register, Home (tabs: Menu, Recipes, Products, Profile)
- Unit tests (17 passing)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

client/lib/core/api/api_client.dart

@@ -0,0 +1,45 @@
+import 'package:dio/dio.dart';
+import '../auth/secure_storage.dart';
+import 'auth_interceptor.dart';
+
+class ApiClient {
+  late final Dio _dio;
+
+  ApiClient({required String baseUrl, required SecureStorageService storage}) {
+    _dio = Dio(BaseOptions(
+      baseUrl: baseUrl,
+      connectTimeout: const Duration(seconds: 10),
+      receiveTimeout: const Duration(seconds: 30),
+      headers: {'Content-Type': 'application/json'},
+    ));
+
+    _dio.interceptors.addAll([
+      AuthInterceptor(storage: storage, dio: _dio),
+      LogInterceptor(requestBody: true, responseBody: true),
+    ]);
+  }
+
+  /// Exposed for testing only.
+  ApiClient.withDio(this._dio);
+
+  Future<Map<String, dynamic>> get(String path,
+      {Map<String, dynamic>? params}) async {
+    final response = await _dio.get(path, queryParameters: params);
+    return response.data;
+  }
+
+  Future<Map<String, dynamic>> post(String path, {dynamic data}) async {
+    final response = await _dio.post(path, data: data);
+    return response.data;
+  }
+
+  Future<Map<String, dynamic>> put(String path, {dynamic data}) async {
+    final response = await _dio.put(path, data: data);
+    return response.data;
+  }
+
+  Future<Map<String, dynamic>> delete(String path) async {
+    final response = await _dio.delete(path);
+    return response.data;
+  }
+}