parity(apps+api): report + report/detail on the internal ledger [ref: henza_pwa views/report]

Ports "گزارش" end to end (D24), the last missing app page.

In the reference this feature computes nothing: Customer\TahesabController
proxies an external accounting system (hesab.henzagold.com and a bare IP at
31.7.68.147:3030) with TLS verification disabled, a bearer token hardcoded in
the source and a URL-embedded secret, keyed on Customer.mcode. The target has
no such system and no mcode, so per the owner's option الف this is built on our
own ledger with no external connection.

API — customer/me/report{,/detail,/balances,/:id}
- one row per CONFIRMED ledger entry with the running gold and rial balance
  after it, newest first as the reference displayed it
- only confirmed entries count, the same rule the cached
  Customer.goldDebtGrams/fiatDebtRial follow, so the statement's closing
  balance agrees with the figure shown everywhere else in the app
- fields the target has no source for (foreign currency, نام کارساخته,
  جنس فلز, the external system's internal ids) are null/zero and the UI OMITS
  the row rather than rendering a fabricated value (REP-01)

SEC-16, NOT ported: the reference's detail($id) took the factor code from the
URL and performed no ownership check at all — it never consults auth() — so any
signed-in customer could read any other customer's document by guessing a code.
Here the id is only a filter on top of a customerId scope from the token.
Tested in both directions.

Apps (both, template+script byte-identical, per-app styling only)
- ReportView with the reference's two tabs, its card rows and its «جزئیات»
  modal; ReportDocument for one document
- routes /report and /report/detail, the latter opening the second tab
- dashboard entry (v1 tile, v2 row), shown to every signed-in customer since
  the reference's hasMCode() gate has no target equivalent

Verified: build 5/5 · jest 45/45 · report 40/40 (new) ·
complete-profile 38/38 · apps smoke 43/43 · typecheck clean on all four apps.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/user-app/src/api/client.ts

@@ -228,6 +228,72 @@ export interface ExpertChildOrder {
   items: OrderItemDetail[];
   customer: { id: string; name: string; mobile: string } | null;
 }
+/**
+ * D24 — "گزارش", the account statement.
+ *
+ * The field names are the reference's (henza_pwa/src/type/accounting.ts), so
+ * the ported components bind exactly as they did. Money and weights travel as
+ * decimal STRINGS, never as JS numbers, so no figure is rounded in transit.
+ */
+export interface ReportRow {
+  id: number;
+  /** The ledger entry id; what the detail call is keyed on. */
+  factor_Code: string;
+  sh_factor: string;
+  tarikh: string;
+  /** Gold in / out, as separate positive columns. */
+  geram_v: string;
+  geram_kh: string;
+  rial_v: string;
+  rial_kh: string;
+  /** Running balances AFTER this row. Signed: negative means in credit. */
+  tahesab_T: string;
+  tahesab_P: string;
+  /** No foreign-currency ledger in the target — always zero (REP-01). */
+  rial_V2: string;
+  rial_Kh2: string;
+  tahesabP2: string;
+  sourceType: string;
+  note: string | null;
+}
+
+export interface ReportPage {
+  result: ReportRow[];
+  count: number;
+  page: number;
+  limit: number;
+}
+
+/** One document's detail. Fields the target cannot know are null, not invented. */
+export interface ReportDetailRow {
+  factor_Code: string;
+  sh_factor: string;
+  tarikh: string;
+  vazn: string;
+  ayar: number | null;
+  no: string;
+  sh_sharti: string | null;
+  name_az: string | null;
+  tabdil750_v: string;
+  tabdil750_kh: string;
+  fi: string | null;
+  fiF: string | null;
+  Darsad_Talayee: string | null;
+  accountName: string | null;
+  bankName: string | null;
+  transferTo: string | null;
+  receivedAt: string | null;
+  note: string | null;
+  nO_kar: null;
+  jens_felez: null;
+  Darsad: null;
+  maliatDarsad: null;
+}
+
+export interface ReportBalance {
+  arz: string;
+  mandeh: string;
+}
 export const api = {
   listProducts: () => request<ProductSummary[]>('/catalog/products'),
 
@@ -328,4 +394,23 @@ export const api = {
       method: 'POST',
       body: JSON.stringify(payload),
     }),
+
+  // ── report / report detail (D24) ─────────────────────────────────────
+  // The reference proxied an external accounting system
+  // (henza_server Customer/TahesabController). These read the target's own
+  // ledger instead — no external call — and the customer comes from the token.
+  getReport: (page = 1) =>
+    request<ReportPage>(`/customer/me/report?page=${page}`),
+  getReportDetailList: (page = 1) =>
+    request<{ result: ReportDetailRow[]; page: number; limit: number }>(
+      `/customer/me/report/detail?page=${page}`,
+    ),
+  getReportBalances: () =>
+    request<{ status: number; message: string; result: ReportBalance[] }>(
+      '/customer/me/report/balances',
+    ),
+  getReportDocument: (id: string) =>
+    request<{ result: ReportDetailRow[]; page: number; limit: number }>(
+      `/customer/me/report/${encodeURIComponent(id)}`,
+    ),
 };