Phase 1 scaffold: auth for all apps

- Backend: Fastify with two listeners (public + internal), routes, services, DB migration + seed
- client_app: Flutter with BLoC, all auth screens (welcome, display name, register, OTP, force-register)
- mitra_app: Flutter with BLoC, OTP-only login
- control_center: React + Vite, email/password login, mitra/user management, anonymity settings
- Docs: phase1 plan, API contract, client app mockup
- CLAUDE.md and shared memory for all subprojects

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

client_app/CLAUDE.md

@@ -0,0 +1,26 @@
+# Halo Bestie — Client App
+
+Flutter mobile application for end users (clients) seeking mental health support.
+
+> See root `CLAUDE.md` for full project context and architectural decisions.
+
+## Stack
+
+- **Framework:** Flutter (iOS + Android)
+- **Auth:** Firebase Auth — Google Sign-In, Apple Sign-In, Phone OTP
+  - Fully native UI — no WebView, no Firebase-branded screens
+  - Use `firebase_auth` + `google_sign_in` packages
+- **API:** Calls public Fastify backend (`/api/client/` and `/api/shared/` routes)
+- **Payment:** Xendit (paid sessions, optional trial)
+
+## Key Concepts
+
+- Users are **clients** — they seek mental health support ("curhat")
+- Core flow: register → browse/match with mitra → book session → chat → pay
+- Trial period available for new users
+
+## Conventions
+
+- Never call `/api/mitra/` or `/internal/` routes from this app
+- All API calls must include Firebase JWT token in `Authorization` header
+- Handle token refresh transparently