Support for web

We have 5kmrun users that don't have a smartphone, or whose smartphone doesn't support the 5kmrun mobile application. For them there is no alternative to participate in the **Selfie chart**. It would be great if we could provide the application in a web version.

---

## Refined scope (2026-07-24)

**Goal:** a minimal **web** build that lets a phone-less user log in and submit their entry to the Selfie chart. This is *not* a full port of the mobile app — only the login → Selfie-submission path.

### In scope
- **Username/password login** (`LoginWithUsername` → `AuthenticationResource.authenticate`). Password auth is **required** — Selfie-chart participation needs a real auth token, which the ID-only login path does not produce.
- The Selfie / offline-chart submission flow (`lib/offline_chart/`): connect Strava, list Strava activities, select one, submit.
- Viewing the Selfie chart (read-only list, already backed by `https://5kmrun.bg/selfie/...`).

### Out of scope (for this MVP)
- Login by personal ID (does not yield a token → cannot submit).
- Barcode, Apple/Google Wallet passes, timekeeping, push notifications, maps.
- Full-app parity.

### Key technical work / blockers
1. **Strava OAuth on web (biggest item).** Submission requires a connected Strava account. Current auth uses the custom scheme `fivekmrun://redirect/` (`lib/state/strava_resource.dart:67`), which cannot work in a browser. Web needs an `https://` redirect URL registered in Strava's app settings and platform-branched auth (`kIsWeb`). Confirm whether `strava_client` supports a web redirect flow, or whether we implement the OAuth code exchange ourselves.
2. **Plugin web-compatibility audit.** Several deps are mobile-only or behave differently on web: `mobile_scanner`, `add_to_google_wallet`, `screen_brightness`, `wakelock_plus`, `app_badge_plus`, `geocoding`, `path_provider`, `audioplayers`. The Selfie path must not import/execute these on web — likely needs `kIsWeb` guards or conditional imports so the web build compiles.
3. **Firebase web config.** `firebase_options.dart` / `firebase_core` need a web app registered in the Firebase project (Analytics/Crashlytics/Remote Config/Messaging web support varies).
4. **Enable the web target** (`flutter create --platforms web .`) and verify the app builds and boots (`flutter build web`).

### Recommended hosting/deploy
- **Firebase Hosting** — the project already uses Firebase, so this is the lowest-friction option (single project, `firebase deploy`, ample free tier). Serve under a subdomain such as `app.5kmrun.bg` via a custom-domain mapping.
- Add a CI job (in `../.github/workflows/`) that runs `flutter build web` and deploys on merge to `master`, mirroring the existing Android/iOS pipeline.

### Acceptance criteria
- [ ] `flutter build web` succeeds; app boots in Chrome with no runtime errors on the Selfie path.
- [ ] User can log in with **username + password** in the browser.
- [ ] User can connect Strava from the browser (https redirect flow) and see their activities.
- [ ] User can submit a Selfie-chart entry from the browser and it appears in the chart.
- [ ] Mobile-only plugins are guarded so they don't break the web build.
- [ ] Deployed to Firebase Hosting (or agreed host) with a documented URL.

### Open questions
- Is a Strava connection acceptable as a hard requirement for web submission, or do phone-less users need a Strava-free path (e.g. manual entry / photo upload)? This materially changes the effort.
- Which subdomain/domain should the web app live on?