test(apps): customer-flow smoke test for both apps + 4-digit master-code guard

smoke-apps.cjs walks login (master OTP), catalogue, cart cap, order placement
and order history, with the empty-order and unauthenticated negatives: 43/43.
The cart rules are executed from BOTH apps' own source so the result cannot be
carried by v1 alone.

No behavioural divergence found: all 9 stores are byte-identical, and the router,
API client and composables match except v1's protected variant-image picker.

APP-01: both apps' OTP box is exactly 4 inputs and only submits at 4, so a longer
OTP_MASTER_CODE cannot be typed into them. The login UI was left alone; main.ts
now warns at boot when the code is not 4 digits and .env.example states the rule.

APP-02 logged, not fixed: user-app-v2 has no getHomeSlider, so admin-configured
home slides show in v1 only. Changing v2's hero during a delivery is not worth
the risk.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -42,6 +42,9 @@ JWT_CUSTOMER_EXPIRES_IN=
 # ⚠ DELIVERY ONLY — REMOVE BEFORE THE REAL RELEASE (D20 / ISSUES REL-01)
 # ---------------------------------------------------------------------------
 # A fixed OTP that signs in ANY active customer, alongside the real code.
+# MUST BE EXACTLY 4 DIGITS: the apps' login box has four single-character
+# inputs and only submits at four (LoginView.vue:43). A longer code still works
+# over the API but cannot be typed into either app.
 # Leave it EMPTY or unset to disable it completely — that is the correct state
 # for production. While it is set, the API prints a warning banner at boot.
 OTP_MASTER_CODE=