frontend phase 1: auth — phone-OTP login, role routing & session refresh

Replace the username/password stub with Balinyaar's real credential (phone-OTP)
and add the role router every authenticated screen sits behind.

- services/auth rewritten for OTP over the b2 contract: types/keys/constants,
  clientApi+mockApi behind a config'd seam, hooks (useRequestOtp/useVerifyOtp/
  useMe/useRefresh/useLogout/useSelectRole/useSessionRoleSync). Stub removed.
- A1/A2 customer login + B1/B2 nurse switch as one OTP flow at /login
  (PhoneStep/OtpStep: auto-verify, resend countdown, wrong/expired/lockout states).
- Role router: pure resolveRoleDestination + RoleRouter -> family / nurse /
  admin / select-role, with a splash while /me loads (no wrong-shell flash).
- SelectRole first-use screen at /select-role.
- Widened AuthState (roles via SessionUser), hydrated from /me by useSessionRoleSync.
- Fetch-layer silent token refresh (single-flight + one retry) + shared
  persistAuthTokens/clearAuthTokens; useRefresh as the on-demand path.
- auth i18n namespace in both locales; tests for routing branches, countdown,
  OtpStep state machine, RoleRouter branches; fixed jest @/ -> src alias.
- Docs: client/CLAUDE.md, frontend STATUS/report, for-backend REQ-002..004.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

client/src/services/auth/hooks/useSelectRole.ts

@@ -0,0 +1,39 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+
+import { COOKIE_NAMES } from '@/lib/cookies';
+import { getClientCookie } from '@/lib/cookies/client';
+import { persistAuthTokens } from '@/lib/auth/session';
+import { useAuth } from '@/context/auth';
+
+import { authApi } from '../apis';
+import { authKeys } from '../keys';
+import { toAppRoles } from '../routing';
+import type { PublicRole } from '../types';
+
+/**
+ * Self-assign a public actor role for a brand-new user. Because role claims live inside the access
+ * token, we rotate the token pair after selecting so subsequent role-gated calls carry the new
+ * claim (contract note). AuthContext and the cached `/me` are then updated so the router re-runs
+ * against the new role.
+ */
+export function useSelectRole() {
+  const queryClient = useQueryClient();
+  const [, dispatch] = useAuth();
+
+  return useMutation({
+    mutationFn: (role: PublicRole) => authApi.selectRole({ role }),
+    onSuccess: async (me) => {
+      const refreshToken = getClientCookie(COOKIE_NAMES.REFRESH_TOKEN);
+      if (refreshToken) {
+        try {
+          persistAuthTokens(await authApi.refresh({ refreshToken }));
+        } catch {
+          // A failed rotation surfaces on the next `/me`/gated call via the fetch layer; the
+          // role is already persisted server-side, so don't block the flow on it.
+        }
+      }
+      dispatch({ type: 'LOG_IN', user: { id: me.id, phone: me.phone, roles: toAppRoles(me.roles) } });
+      queryClient.setQueryData(authKeys.me(), me);
+    },
+  });
+}