Implement Bufdir API authentication handler

Architecture: implement BufdirAuthHandler as a Dart class inside a Supabase Edge Function (Deno TypeScript) rather than inside the Flutter app — the mobile app calls the Edge Function, which handles authentication and credential retrieval server-side, then proxies the authenticated request to Bufdir. This keeps all Bufdir credentials server-side. The Flutter-side BufdirApiClientImpl should only know the Edge Function URL and the user's Supabase JWT. For the token concurrency issue (multiple simultaneous requests triggering duplicate token fetches), use a Dart Completer pattern: if a token fetch is in progress, queue subsequent calls on the same Completer rather than issuing new requests.

For the OAuth2/API-key mode switching, define a BufdirCredentialConfig sealed class with two subtypes: BufdirOAuth2Config and BufdirApiKeyConfig — the vault returns one of these, and the handler switches behavior via pattern matching. Ensure the token expiry buffer (60s) is configurable via a constant for easy tuning during API integration testing.

Unit tests with mocktail mocking the HTTP client and vault client: (1) successful OAuth2 flow — mock token endpoint returning valid token, assert BufdirAuthToken fields populated correctly; (2) cache hit — call authenticate() twice, assert HTTP client called exactly once; (3) token expiry within 60s — mock token with expires_in=50, assert second authenticate() call triggers new token fetch; (4) 401 retry — mock first call returning 401, second returning 200, assert refreshToken called and final result is success; (5) double 401 — mock both calls returning 401, assert BufdirAuthException thrown; (6) vault failure — mock vault throwing, assert BufdirAuthException thrown with VaultUnavailable error type; (7) API-key fallback — mock null OAuth2 credentials, assert API key header attached. Integration test (against Supabase Edge Function test environment): authenticate() with real vault credentials succeeds. No tests should use real Bufdir API endpoints.