docs: add scan-product reference and update backend/root plans for enhancements

plans/next-enhancements.md

@@ -74,8 +74,54 @@ When complete, the status flips to `[DONE]` and the feature is logged in
 - **4.2** [TODO] Block save when a line item's SKU isn't in the master registry, instead of only relabeling it for display. The SKU listener in `_addItem` (`editor_screen.dart:108-115`) sets the item name to "SKU Tidak Terdaftar" for an unrecognized SKU but doesn't stop form submission, so a document with an unregistered/mistyped SKU can still be saved and its receipt printed.
 - **4.3** [TODO] Include the captured GPS coordinates on the printed PDF receipt. `PdfService.generateAndPrintReceipt` (`pdf_service.dart:36-52`) prints header/shipment/item fields but never includes `document.latitude`/`longitude`, even though the editor captures and displays them (`_latitudeCtrl`/`_longitudeCtrl`) — the geotag exists in the data model but isn't part of the audit-trail document a store keeps.
 
+### 5. Flutter — Connectivity & Endpoint Resolution
+`lib/config/app_config.dart`, `lib/core/network/api_client.dart`
+
+Added 2026-07-08 via a user-directed `e` run ("dual endpoint: local first, public
+ngrok fallback"). **Current-state audit**: the requested dual-endpoint fallback
+*already exists at startup* — `AppConfig.initializeApiBaseUrl()`
+(`app_config.dart:32-49`) probes the LAN URL first, falls back to the reserved
+ngrok domain, and validates each probe is a *real* backend (checks the
+`ngrok-error-code` header, JSON content-type, and 502/503/504) with the
+`ngrok-skip-browser-warning` header set. (Root `CLAUDE.md` describes this order
+backwards — tracked as a doc fix in backend task 5.1d.) These tasks close what's
+actually missing:
+
+- **5.1** [TODO] **Mid-session endpoint failover.** Resolution runs exactly once at
+  startup, and `ApiClient` freezes `baseUrl` at construction of a singleton
+  (`api_client.dart:13`, `apiClientProvider`) — a phone that resolves LAN on Wi-Fi
+  and then leaves the building fails every subsequent call with no path back to
+  the ngrok endpoint (and vice versa) until an app restart. Add a Dio interceptor
+  that, on *connectivity-class* failures only (`connectionTimeout`/
+  `connectionError` — not HTTP-level errors), re-runs endpoint resolution and
+  retries the request once against the newly resolved endpoint. Implementation
+  notes: the frozen-at-construction `baseUrl` must become dynamic (set
+  `_dio.options.baseUrl` on re-resolution, or read `AppConfig.apiBaseUrl` in the
+  existing `onRequest` interceptor); retry-once is safe for the upload path
+  because the backend dedups by `file_hash` (backend task 1.1), but audit other
+  POST/PUT call sites before blanket-retrying. Coordinate with 3.3 (explicit Dio
+  timeouts) — a hung connection must fail fast enough for failover to matter.
+- **5.2** [TODO] **Endpoint status visibility + manual re-probe.** Show which
+  endpoint the app is on (LAN / Public / unreachable) as a small persistent
+  indicator (camera screen or drawer) with a tap-to-re-probe action, so a driver
+  or tester can see and fix "wrong/stale endpoint" in the field without reading
+  logs — a stale tunnel is the documented first failure point for login/upload
+  (root `CLAUDE.md`). Re-probe reuses 5.1's resolution path.
+- **5.3** [TODO] **Make both endpoint URLs configurable without a code edit.**
+  `_lanBaseUrl` and `_ngrokBaseUrl` are compile-time consts — the LAN one is
+  regex-patched by `start-dev-tunnel.ps1` (which breaks silently if the const is
+  renamed/moved; the script warns but the app still ships the stale IP), the ngrok
+  one requires a manual source edit if the reserved domain ever changes. Add a
+  runtime override (e.g. long-press-hidden settings sheet writing to
+  `SharedPreferences`, seeded from the compiled defaults) so a field device can be
+  repointed without rebuilding the APK. Keep the script's patch working (or teach
+  it to fail loudly — backend task 4.3 covers verifying the tunnel end). Once
+  backend task 1.6 ships `GET /api/v1/health`, switch `_isBackendReachable`'s
+  probe to it — probing `POST /auth/login` with an empty body works but couples
+  reachability to the login route's error shape.
+
 ---
 
-*Sections 1-4 (Flutter) are the only sections this file tracks. Backend
+*Sections 1-5 (Flutter) are the only sections this file tracks. Backend
 enhancements (formerly sections 5-8 here, removed 2026-07-08) now live
 exclusively in [backend/plans/next-enhancements.md](../backend/plans/next-enhancements.md).*