refactor(structure): pilot migration — onboarding feature (login, QR, invitations, consent)

## Problem
Onboarding (`login_page.dart`, `qr_scanner.dart`, `invitation_*.dart`, `informed_consent_page.dart` + their view-models) is the most self-contained slice and the one with the worst widget→backend coupling (see #604).

## Proposed fix
Move the slice into `features/onboarding/{ui,view_models}` with explicit imports; do it in the same PR series as the corresponding #604 sub-issues so files move once, already cleaned.

## Acceptance criteria
- [ ] Onboarding flow works end-to-end (local + test server)
- [ ] No file outside `features/onboarding` imports its internals

**Effort:** M · **Priority:** P2 · **Change risk:** Low-medium