frontend phase 1: auth — phone-OTP login, role routing & session refresh

Replace the username/password stub with Balinyaar's real credential (phone-OTP)
and add the role router every authenticated screen sits behind.

- services/auth rewritten for OTP over the b2 contract: types/keys/constants,
  clientApi+mockApi behind a config'd seam, hooks (useRequestOtp/useVerifyOtp/
  useMe/useRefresh/useLogout/useSelectRole/useSessionRoleSync). Stub removed.
- A1/A2 customer login + B1/B2 nurse switch as one OTP flow at /login
  (PhoneStep/OtpStep: auto-verify, resend countdown, wrong/expired/lockout states).
- Role router: pure resolveRoleDestination + RoleRouter -> family / nurse /
  admin / select-role, with a splash while /me loads (no wrong-shell flash).
- SelectRole first-use screen at /select-role.
- Widened AuthState (roles via SessionUser), hydrated from /me by useSessionRoleSync.
- Fetch-layer silent token refresh (single-flight + one retry) + shared
  persistAuthTokens/clearAuthTokens; useRefresh as the on-demand path.
- auth i18n namespace in both locales; tests for routing branches, countdown,
  OtpStep state machine, RoleRouter branches; fixed jest @/ -> src alias.
- Docs: client/CLAUDE.md, frontend STATUS/report, for-backend REQ-002..004.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

client/src/services/auth/routing.ts

@@ -0,0 +1,47 @@
+import { APP_ROLES, ROUTES, type AppRole } from '@/constants';
+import type { Me, RoleCode } from './types';
+
+const ADMIN_ROLES: RoleCode[] = ['admin', 'support', 'finance', 'moderation', 'super_admin'];
+
+export function isAdminRole(role: RoleCode): boolean {
+  return ADMIN_ROLES.includes(role);
+}
+
+/**
+ * Collapse the server's fine-grained role codes to the three actor experiences the shells
+ * render. Admin sub-roles all map to the single ADMIN shell; unknown/non-public codes drop out.
+ */
+export function toAppRoles(roles: RoleCode[]): AppRole[] {
+  const actors = new Set<AppRole>();
+  for (const role of roles) {
+    if (role === 'customer') actors.add(APP_ROLES.CUSTOMER);
+    else if (role === 'nurse') actors.add(APP_ROLES.NURSE);
+    else if (isAdminRole(role)) actors.add(APP_ROLES.ADMIN);
+  }
+  return [...actors];
+}
+
+/**
+ * The locale-less path a signed-in user should land on after auth — the pure core of the role
+ * router (the component just navigates to it). `intendedRole` is the role carried from the login
+ * switch (A1 vs B1); it only disambiguates a user who holds **both** customer and nurse.
+ *
+ * A nurse always routes to the nurse app here; the B3 "verification in progress" landing for an
+ * unverified nurse is f5's job (this only routes correctly, it doesn't render the banner).
+ */
+export function resolveRoleDestination(me: Pick<Me, 'roles'>, intendedRole?: AppRole): string {
+  if (me.roles.length === 0) return ROUTES.SELECT_ROLE;
+  if (me.roles.some(isAdminRole)) return ROUTES.ADMIN;
+
+  const hasNurse = me.roles.includes('nurse');
+  const hasCustomer = me.roles.includes('customer');
+
+  let target: AppRole;
+  if (hasNurse && hasCustomer) {
+    target = intendedRole === APP_ROLES.NURSE ? APP_ROLES.NURSE : APP_ROLES.CUSTOMER;
+  } else {
+    target = hasNurse ? APP_ROLES.NURSE : APP_ROLES.CUSTOMER;
+  }
+
+  return target === APP_ROLES.NURSE ? ROUTES.NURSE : ROUTES.HOME;
+}