feat(apps): sales-expert screens in both apps + v2 admin home slider (D21, APP-02)

Both expert screens are built in user-app and user-app-v2, with byte-identical
template and script and a per-app style block only — verified by diffing
everything above <style>:

  ChildOrdersView  "سفارش مشتریان"  — legacy ChildOrders.vue. Keeps the
    reference's title, search, infinite paging, and per-card item count, total
    weight, customer name and the fixed «تحویل مسئول فروش» chip (the endpoint
    only returns that status, ApiMobileController:766).
  CustomerChoiceView "لیست مشتریان" — legacy customerChoice.vue. Keeps its
    title, per-search re-query and the reference's choice to LIST inactive
    customers (its active() scope is commented out at :187).

Reachable from inside the app, not just by URL: routes carry the reference's own
paths and names, the dashboard grows the two entries only for an expert (v1 as
tiles, v2 as its own rows), and a router guard sends an ordinary customer back
to their dashboard. None of that is relied on for safety — the server scopes
both endpoints on the AdminUser id in the token and answers 403 otherwise.

Not ported, both recorded in D21: the act-as api_token minting (:197-201) and
the child-order edit drawer, which recomputed an order's money from client-sent
values. The card opens a read-only summary instead.

APP-02 fixed: user-app-v2 gained getHomeSlider and now prefers admin-configured
slides, keeping its category-derived hero as the fallback and its own design.

Session stores stay byte-identical across the apps.
build 5/5, jest 45/45, expert login 36/36, apps smoke 43/43, typecheck clean.

[ref: henza_pwa/src/views/user/src/components/ChildOrders.vue, customerChoice.vue]
[ref: henza_pwa/src/router/index.ts:171-188]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/user-app-v2/src/views/user/DashboardView.vue

@@ -151,6 +151,37 @@
           </span>
           <Icon icon="vuesax-linear:arrow-left-2" size="16" color="#8A909C" />
         </button>
+
+        <!--
+          D21 — the two sales-expert entries, rendered only for an expert, in
+          v2's own row style. The reference showed them the same way, gated on
+          the agent's own account (Dashboard.vue:117-125). An ordinary customer
+          never sees them, and the server refuses both routes for a non-expert
+          token regardless of what the app renders.
+        -->
+        <template v-if="session.isSalesExpert">
+          <button type="button" class="dash__row" @click="goToDetails(4)">
+            <span class="dash__rowIcon" aria-hidden="true">
+              <Icon icon="vuesax-linear:box-tick" size="18" />
+            </span>
+            <span class="dash__rowText">
+              <b>سفارش مشتریان</b>
+              <small>سفارش‌های مشتریان معرفی‌شده شما</small>
+            </span>
+            <Icon icon="vuesax-linear:arrow-left-2" size="16" color="#8A909C" />
+          </button>
+
+          <button type="button" class="dash__row" @click="goToDetails(5)">
+            <span class="dash__rowIcon" aria-hidden="true">
+              <Icon icon="vuesax-linear:profile-2user" size="18" />
+            </span>
+            <span class="dash__rowText">
+              <b>مشتریان من</b>
+              <small>فهرست مشتریان معرفی‌شده شما</small>
+            </span>
+            <Icon icon="vuesax-linear:arrow-left-2" size="16" color="#8A909C" />
+          </button>
+        </template>
       </section>
 
       <!-- Live 18k rate — a single inline row, not a titled section. -->
@@ -227,6 +258,8 @@ function goToDetails(id: number) {
   if (id === 1) router.push({ name: 'transactionsList' })
   if (id === 2) router.push({ name: 'profileData' })
   if (id === 3) router.push({ name: 'favoritesList' })
+  if (id === 4) router.push({ name: 'ChildOrder' })
+  if (id === 5) router.push({ name: 'customerChoice' })
 }
 
 function logOut() {

apps/user-app-v2/src/views/user/LoginView.vue

@@ -165,6 +165,16 @@ const sendToken = async (otpCode: string) => {
     body.loading = true
     const { token, customer } = await api.verifyOtp(String(formModel.username ?? ''), otpCode)
     session.login(token, customer.id, customer.mobile)
+    // D21 — ask the server which kind of principal this token is, so the
+    // expert-only entries appear for a sales expert. Failure is non-fatal:
+    // the entries simply stay hidden, and the server refuses those routes
+    // for anyone who is not an expert anyway.
+    try {
+      const who = await api.getExpertIdentity()
+      session.setSalesExpert(who.isSalesExpert)
+    } catch {
+      session.setSalesExpert(false)
+    }
     const redirect = typeof route.query.redirect === 'string' ? route.query.redirect : undefined
     await router.push(redirect ?? { name: 'home' })
     notify.text = 'با موفقیت وارد شدید'