Initial commit: Flutter app + PHP/MySQL backend on Hostinger

Replaces Firebase with a self-hosted PHP/MySQL API served from
winded.prymsolutions.com. Includes full backend (schema, auth, events,
teams, brackets, suggestions, stats, media, file upload) and updated
Flutter repositories and domain models.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/features/auth/infrastructure/auth_repository.dart

@@ -0,0 +1,112 @@
+import 'dart:async';
+
+import 'package:riverpod_annotation/riverpod_annotation.dart';
+
+import '../../../core/api/api_client.dart';
+import '../domain/app_user.dart';
+
+part 'auth_repository.g.dart';
+
+/// Manages auth state backed by the PHP/MySQL API.
+///
+/// Because the backend has no push mechanism, auth state is held in memory and
+/// exposed via a [StreamController]. Sign-in and registration update the stream
+/// immediately; the token is persisted in [FlutterSecureStorage] via [ApiClient].
+class AuthRepository {
+  AuthRepository(this._api) {
+    _init();
+  }
+
+  final ApiClient _api;
+  final _controller = StreamController<AppUser?>.broadcast();
+
+  Stream<AppUser?> authStateChanges() => _controller.stream;
+  AppUser? get currentUser => _currentUser;
+  AppUser? _currentUser;
+
+  Future<void> _init() async {
+    final token = await _api.token;
+    if (token == null) {
+      _emit(null);
+      return;
+    }
+    try {
+      final data = await _api.get('/auth/me.php');
+      final user = _mapUser(data);
+      _emit(user);
+    } catch (_) {
+      await _api.clearToken();
+      _emit(null);
+    }
+  }
+
+  Future<AppUser?> signInWithEmail({
+    required String email,
+    required String password,
+  }) async {
+    final data = await _api.post(
+      '/auth/login.php',
+      {'email': email.trim(), 'password': password},
+      auth: false,
+    );
+    await _api.saveToken(data['token'] as String);
+    final user = _mapUser(data['user'] as Map<String, dynamic>);
+    _emit(user);
+    return user;
+  }
+
+  Future<AppUser?> registerWithEmail({
+    required String email,
+    required String password,
+    String? displayName,
+  }) async {
+    final data = await _api.post(
+      '/auth/register.php',
+      {
+        'email': email.trim(),
+        'password': password,
+        'display_name': displayName?.trim() ?? '',
+      },
+      auth: false,
+    );
+    await _api.saveToken(data['token'] as String);
+    final user = _mapUser(data['user'] as Map<String, dynamic>);
+    _emit(user);
+    return user;
+  }
+
+  Future<void> signOut() async {
+    await _api.clearToken();
+    _emit(null);
+  }
+
+  void _emit(AppUser? user) {
+    _currentUser = user;
+    _controller.add(user);
+  }
+
+  AppUser? _mapUser(Map<String, dynamic> data) {
+    final id = data['id'] as String?;
+    if (id == null || id.isEmpty) return null;
+    return AppUser(
+      uid: id,
+      email: (data['email'] as String?) ?? '',
+      displayName: data['display_name'] as String?,
+      photoUrl: data['photo_url'] as String?,
+    );
+  }
+
+  void dispose() => _controller.close();
+}
+
+@Riverpod(keepAlive: true)
+AuthRepository authRepository(AuthRepositoryRef ref) {
+  final repo = AuthRepository(ref.watch(apiClientProvider));
+  ref.onDispose(repo.dispose);
+  return repo;
+}
+
+@Riverpod(keepAlive: true)
+Stream<AppUser?> authStateChanges(AuthStateChangesRef ref) {
+  return ref.watch(authRepositoryProvider).authStateChanges();
+}

lib/features/auth/infrastructure/auth_repository.g.dart

@@ -0,0 +1,44 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+// ignore_for_file: type=lint
+// ignore_for_file: subtype_of_sealed_class, invalid_use_of_internal_member, invalid_use_of_visible_for_testing_member, deprecated_member_use_from_same_package, deprecated_member_use
+
+part of 'auth_repository.dart';
+
+// **************************************************************************
+// RiverpodGenerator
+// **************************************************************************
+
+String _$authRepositoryHash() => r'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2';
+
+/// See also [authRepository].
+@ProviderFor(authRepository)
+final authRepositoryProvider = Provider<AuthRepository>.internal(
+  authRepository,
+  name: r'authRepositoryProvider',
+  debugGetCreateSourceHash:
+      const bool.fromEnvironment('dart.vm.product')
+          ? null
+          : _$authRepositoryHash,
+  dependencies: null,
+  allTransitiveDependencies: null,
+);
+
+typedef AuthRepositoryRef = ProviderRef<AuthRepository>;
+
+String _$authStateChangesHash() => r'b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3';
+
+/// See also [authStateChanges].
+@ProviderFor(authStateChanges)
+final authStateChangesProvider = StreamProvider<AppUser?>.internal(
+  authStateChanges,
+  name: r'authStateChangesProvider',
+  debugGetCreateSourceHash:
+      const bool.fromEnvironment('dart.vm.product')
+          ? null
+          : _$authStateChangesHash,
+  dependencies: null,
+  allTransitiveDependencies: null,
+);
+
+typedef AuthStateChangesRef = StreamProviderRef<AppUser?>;