[DidoraRudenko]

What was added

Network layer, authentication, and services for the desktop client (files 02 and 03 from docs/desktop-migration).

• DTO (ApiContracts.hpp): models synced with the real API (packages/api-contracts and apps/api). Supported both naming conventions (questionScores / question_scores), Unknown for unrecognized enums, std::optional via adl_serializer, and error parsing for three formats ({error, code}, ProblemDetails, Supabase Auth).
• ApiClient: 90s (Render cold start) and 30s timeouts, isWakingUp state, retries for GET requests only (up to 2), refresh queue on 401 with request replay.
• AuthService: login and signup via Supabase REST (/auth/v1/token, /auth/v1/signup), GET /api/auth/me, "confirm email" handling, restoreSession(), and mockLogin without the admin role in Release.
• InterviewService (including getOptions()) and AdminService.
• Token Storage: ISecureStorage interface, QtKeychainSecureStorage, and InMemorySecureStorage implementations. Access and refresh tokens are stored under separate keys; no tokens are saved to disk.
• AuthViewModel with the public interface mapped from document 03.
• Tests (GoogleTest, 27 items): DTOs, error parsing, secure storage, ApiClient (refresh queue on a local QTcpServer), AuthService.

Changes in shared files

• CMakeLists.txt: added Qt6Keychain, test target, and windeployqt.
• vcpkg.json: added builtin-baseline, qtkeychain-qt6, and gtest.
• .env.example, .gitignore.

What the team needs to know

• ISecureStorage accepts std::string_view (not const std::string&).
• ApiError has an explicit constructor.
• Categories, levels, and languages in the UI must be fetched from InterviewService::getOptions() (GET /api/options), do not hardcode them. The backend includes a senior level, and trainee might be missing.
• Candidate message limit is 3000 characters; the UI must validate this as well.
• Configuration via environment variables: DEV_DIALOGUE_SUPABASE_ANON_KEY, Supabase URL, and API URL (see .env.example). The client only uses the anon key.

How to test

Build in "x64 Native Tools Command Prompt for VS" (MSVC + Ninja):

cmake -B apps/desktop/build -S apps/desktop -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_TOOLCHAIN_FILE=C:/vcpkg/scripts/buildsystems/vcpkg.cmake
cmake --build apps/desktop/build --config Release
ctest --test-dir apps/desktop/build -C Release --output-on-failure

Verified: Release and Debug builds, 27 out of 27 tests passed.

Known limitations (to be addressed separately)

• Token refresh is tested only on mocks, not against real Supabase and Render environments.
• There are two duplicate safeguards against concurrent refreshes (in ApiClient and AuthService). We need to keep only one and add a test for simultaneous scheduled refresh and a 401 error.
• QtKeychainSecureStorage has not been tested on a live OS credential vault.
• InterviewService and AdminService do not have tests yet.
• NavigationViewModel and registration in main.cpp are not included in this PR.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.