frontend phase 1: auth — phone-OTP login, role routing & session refresh

Replace the username/password stub with Balinyaar's real credential (phone-OTP)
and add the role router every authenticated screen sits behind.

- services/auth rewritten for OTP over the b2 contract: types/keys/constants,
  clientApi+mockApi behind a config'd seam, hooks (useRequestOtp/useVerifyOtp/
  useMe/useRefresh/useLogout/useSelectRole/useSessionRoleSync). Stub removed.
- A1/A2 customer login + B1/B2 nurse switch as one OTP flow at /login
  (PhoneStep/OtpStep: auto-verify, resend countdown, wrong/expired/lockout states).
- Role router: pure resolveRoleDestination + RoleRouter -> family / nurse /
  admin / select-role, with a splash while /me loads (no wrong-shell flash).
- SelectRole first-use screen at /select-role.
- Widened AuthState (roles via SessionUser), hydrated from /me by useSessionRoleSync.
- Fetch-layer silent token refresh (single-flight + one retry) + shared
  persistAuthTokens/clearAuthTokens; useRefresh as the on-demand path.
- auth i18n namespace in both locales; tests for routing branches, countdown,
  OtpStep state machine, RoleRouter branches; fixed jest @/ -> src alias.
- Docs: client/CLAUDE.md, frontend STATUS/report, for-backend REQ-002..004.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

client/src/context/auth/index.ts

@@ -1,4 +1,4 @@
 export { AuthProvider, useAuth } from './AuthContext';
 export type { AuthContextValue } from './AuthContext';
 export { INITIAL_AUTH_STATE } from './types';
-export type { AuthAction, AuthState } from './types';
+export type { AuthAction, AuthState, SessionUser } from './types';

client/src/context/auth/types.ts

@@ -1,11 +1,23 @@
-import type { User } from '@/services/auth/types';
+import type { AppRole } from '@/constants';
+
+/**
+ * The session identity the shells need for chrome. `roles` are the coarse actor roles
+ * (customer/nurse/admin) derived from the server's fine-grained role codes via
+ * `toAppRoles`; `id` is optional because verify_otp returns roles but not the id — `/me`
+ * (via useSessionRoleSync) fills it once loaded.
+ */
+export interface SessionUser {
+  id?: number;
+  phone: string;
+  roles: AppRole[];
+}
 
 export interface AuthState {
   isAuthenticated: boolean;
-  currentUser?: User;
+  currentUser?: SessionUser;
 }
 
-export type AuthAction = { type: 'LOG_IN'; user?: User } | { type: 'LOG_OUT' };
+export type AuthAction = { type: 'LOG_IN'; user?: SessionUser } | { type: 'LOG_OUT' };
 
 export const INITIAL_AUTH_STATE: AuthState = {
   isAuthenticated: false,