Implement location privacy configuration loader

Implement as a Riverpod `AsyncNotifier` for clean loading/error/data state management. Store the last-fetched timestamp alongside the cached config — compare `DateTime.now().difference(lastFetched) > ttl` on each read to determine cache staleness. Use a `const Duration(minutes: 15)` default TTL, overridable via provider parameter for testing. The fallback config should contain hardcoded strings that are legally safe (generic GDPR consent language, a placeholder URL that opens the app's about screen).

For the Supabase query, use a `.select()` call filtered by `organisation_id` matching the current session's org claim — avoid fetching all organisations' configs. Model the GDPR lawful basis as a Dart enum `GdprLawfulBasis { consent, legitimateInterest, legalObligation }` with a `fromString` factory for JSON deserialization. This component will be consumed by the consent dialog UI (downstream task) and by the LocationConsentService, so keep the API surface minimal and focused on read-only access.

Unit tests using flutter_test and mocktail. Test cases: (1) First call fetches from Supabase mock and caches result — verify Supabase client called exactly once; (2) Second call within TTL returns cached result — verify Supabase client NOT called again; (3) Call after TTL expiry re-fetches — verify Supabase client called again; (4) Supabase error on fetch — verify fallback default config returned and no exception thrown; (5) refresh() call invalidates cache and triggers re-fetch; (6) privacyPolicyUrl with HTTP scheme is rejected and replaced with fallback URL; (7) Riverpod provider emits AsyncLoading, then AsyncData with correct config. Use `FakeAsync` from `fake_async` package to simulate TTL expiry without real time delays in tests.