poc(flutter): web OAuth/CORS/runner polish, simulation tests & docs post-PR #28

[cemal-yilmaz-bt]

Goal

Land follow-up commits on branch feat/issue-27-flutter-poc-parity after the first merge of #28: Chrome/web OAuth stability, simulation and review fixes, unit tests, and documentation.

Context

• Epic #3

Acceptance criteria

• Flutter web OAuth: reload-safe callback flow; launchUrl uses current tab on web (_self)
• Storage split: web in-memory PoC vs native ContextStore adapter when init succeeds
• Keycloak: localhost:4200 in webOrigins for morph-login/device/session; extended auth-code lifetimes; run_web defaults to profile mode
• Flutter web/ scaffold in repo
• Simulation/MockApiSheet fixes from feat(poc): Flutter POC feature parity with TS Vue POC #28 review (session-dead condition parentheses, timeouts, UX)
• flutter test for parsePocSimulationJson, isPocSessionDeadStop, mocked fetch
• Docs: dart-parity, poc-guide, poc/simulation.md, docs README updated

Out of scope

• CI for flutter-poc (path deps; follow-up).

Base

f/plugin

[cemal-yilmaz-bt]

Closed manually: merged into f/plugin via #30 (GitHub does not always auto-close issues when the PR base is not the default branch).