frontend phase 1: auth — phone-OTP login, role routing & session refresh

Replace the username/password stub with Balinyaar's real credential (phone-OTP)
and add the role router every authenticated screen sits behind.

- services/auth rewritten for OTP over the b2 contract: types/keys/constants,
  clientApi+mockApi behind a config'd seam, hooks (useRequestOtp/useVerifyOtp/
  useMe/useRefresh/useLogout/useSelectRole/useSessionRoleSync). Stub removed.
- A1/A2 customer login + B1/B2 nurse switch as one OTP flow at /login
  (PhoneStep/OtpStep: auto-verify, resend countdown, wrong/expired/lockout states).
- Role router: pure resolveRoleDestination + RoleRouter -> family / nurse /
  admin / select-role, with a splash while /me loads (no wrong-shell flash).
- SelectRole first-use screen at /select-role.
- Widened AuthState (roles via SessionUser), hydrated from /me by useSessionRoleSync.
- Fetch-layer silent token refresh (single-flight + one retry) + shared
  persistAuthTokens/clearAuthTokens; useRefresh as the on-demand path.
- auth i18n namespace in both locales; tests for routing branches, countdown,
  OtpStep state machine, RoleRouter branches; fixed jest @/ -> src alias.
- Docs: client/CLAUDE.md, frontend STATUS/report, for-backend REQ-002..004.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

client/src/services/auth/apis/clientApi.ts

@@ -1,16 +1,63 @@
 import { clientFetch } from '@/lib/api/client';
-import type { AuthTokens, LoginDto, User } from '../types';
+import { unwrap, type ApiEnvelope } from '@/lib/api/types';
+import { AUTH_API_BASE } from '../constants';
+import type {
+  AuthApi,
+  AuthTokens,
+  LogoutRequest,
+  Me,
+  OtpRequest,
+  OtpVerify,
+  RefreshRequest,
+  RequestOtpResult,
+  SelectRoleDto,
+} from '../types';
 
-export const AuthClientApi = {
-  login: (dto: LoginDto) =>
-    clientFetch<AuthTokens>('/auth/login', {
+/**
+ * Real HTTP implementation of the AuthApi seam. `clientFetch` returns the raw server
+ * envelope, so each call reads its payload via `unwrap`. Routes are the exact snake_case
+ * paths from the published swagger (`[controller]/[action]` transform).
+ */
+export const authClientApi: AuthApi = {
+  requestOtp: async (body: OtpRequest) =>
+    unwrap(
+      await clientFetch<ApiEnvelope<RequestOtpResult>>(`${AUTH_API_BASE}/auth/request_otp`, {
+        method: 'POST',
+        body: JSON.stringify(body),
+      }),
+    ),
+
+  verifyOtp: async (body: OtpVerify) =>
+    unwrap(
+      await clientFetch<ApiEnvelope<AuthTokens>>(`${AUTH_API_BASE}/auth/verify_otp`, {
+        method: 'POST',
+        body: JSON.stringify(body),
+      }),
+    ),
+
+  refresh: async (body: RefreshRequest) =>
+    unwrap(
+      await clientFetch<ApiEnvelope<AuthTokens>>(`${AUTH_API_BASE}/auth/refresh`, {
+        method: 'POST',
+        body: JSON.stringify(body),
+      }),
+    ),
+
+  // Success is an empty envelope (no `data`) — don't unwrap, just await the revocation.
+  logout: async (body?: LogoutRequest) => {
+    await clientFetch<ApiEnvelope<void>>(`${AUTH_API_BASE}/auth/logout`, {
       method: 'POST',
-      body: JSON.stringify(dto),
-    }),
+      body: JSON.stringify(body ?? {}),
+    });
+  },
 
-  logout: () =>
-    clientFetch<void>('/auth/logout', { method: 'POST' }),
+  getMe: async () => unwrap(await clientFetch<ApiEnvelope<Me>>(`${AUTH_API_BASE}/me`)),
 
-  getCurrentUser: () =>
-    clientFetch<User>('/auth/me'),
+  selectRole: async (body: SelectRoleDto) =>
+    unwrap(
+      await clientFetch<ApiEnvelope<Me>>(`${AUTH_API_BASE}/me/select_role`, {
+        method: 'POST',
+        body: JSON.stringify(body),
+      }),
+    ),
 };