Build consent grant and status check service

Define a `ConsentStatus` enum with three values: `granted`, `notGranted`, `revoked`. The distinction between `notGranted` and `revoked` is important: `revoked` triggers a different UI message ('You previously consented but have withdrawn — re-grant to use the map') vs `notGranted` ('Enable location sharing to appear on the peer mentor map'). For atomicity of grant + audit write, implement as a Supabase RPC function `grant_consent(p_mentor_id, p_org_id, p_version, p_ip_hash)` that performs both writes in a PostgreSQL transaction — do not rely on two sequential Supabase client calls from Flutter, as network interruption between them can leave data in an inconsistent state. The ConsentGatingMixin should be implemented as a Dart mixin with a single method `Future withConsentCheck(String mentorId, String orgId, Future Function() operation)` — call `checkConsent` first, throw `ConsentRequiredException` if not granted, then call `operation()`.

This pattern makes it impossible to accidentally bypass consent checks in new location service methods. Expose `LocationConsentService` via a Riverpod `Provider` (not `AsyncNotifier`) since the service itself is synchronously constructible — only its async methods return futures.

Unit tests using flutter_test and mocktail for all service methods. Test cases: (1) grantConsent with matching version — verify upsert called with correct parameters and audit event written; (2) grantConsent with mismatched version — verify ConsentVersionMismatchException thrown and no database write attempted; (3) checkConsent when active row exists — verify returns ConsentStatus.granted; (4) checkConsent when no row exists — verify returns ConsentStatus.notGranted; (5) checkConsent when revoked_at IS NOT NULL — verify returns ConsentStatus.revoked; (6) revokeConsent — verify revoked_at set, audit event written, and delete_mentor_location_data RPC called; (7) Transaction rollback simulation — mock the audit write to throw, verify the grant/revoke was also rolled back (i.e., the mock upsert was called but the overall operation throws); (8) ConsentGatingMixin — verify a wrapped method is blocked with ConsentRequiredException when checkConsent returns notGranted. Integration tests (separate) should verify the actual RLS enforcement using a local Supabase instance.