feat(apps): sales-expert screens in both apps + v2 admin home slider (D21, APP-02)

Both expert screens are built in user-app and user-app-v2, with byte-identical
template and script and a per-app style block only — verified by diffing
everything above <style>:

  ChildOrdersView  "سفارش مشتریان"  — legacy ChildOrders.vue. Keeps the
    reference's title, search, infinite paging, and per-card item count, total
    weight, customer name and the fixed «تحویل مسئول فروش» chip (the endpoint
    only returns that status, ApiMobileController:766).
  CustomerChoiceView "لیست مشتریان" — legacy customerChoice.vue. Keeps its
    title, per-search re-query and the reference's choice to LIST inactive
    customers (its active() scope is commented out at :187).

Reachable from inside the app, not just by URL: routes carry the reference's own
paths and names, the dashboard grows the two entries only for an expert (v1 as
tiles, v2 as its own rows), and a router guard sends an ordinary customer back
to their dashboard. None of that is relied on for safety — the server scopes
both endpoints on the AdminUser id in the token and answers 403 otherwise.

Not ported, both recorded in D21: the act-as api_token minting (:197-201) and
the child-order edit drawer, which recomputed an order's money from client-sent
values. The card opens a read-only summary instead.

APP-02 fixed: user-app-v2 gained getHomeSlider and now prefers admin-configured
slides, keeping its category-derived hero as the fallback and its own design.

Session stores stay byte-identical across the apps.
build 5/5, jest 45/45, expert login 36/36, apps smoke 43/43, typecheck clean.

[ref: henza_pwa/src/views/user/src/components/ChildOrders.vue, customerChoice.vue]
[ref: henza_pwa/src/router/index.ts:171-188]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/user-app/src/router/index.ts

@@ -36,6 +36,22 @@ export const router = createRouter({
     },
     { path: '/profile', name: 'profileData', component: () => import('../views/user/ProfileView.vue'), meta: { requiresAuth: true } },
     { path: '/favorites', name: 'favoritesList', component: () => import('../views/user/FavoritesView.vue'), meta: { requiresAuth: true } },
+    // D21 — the sales expert's two screens. Reference paths and names kept
+    // (henza_pwa router/index.ts:171-188). requiresExpert is enforced by the
+    // guard below AND by the server, which scopes both endpoints on the
+    // AdminUser id in the token and answers 403 for anyone else.
+    {
+      path: '/ChildOrder',
+      name: 'ChildOrder',
+      component: () => import('../views/expert/ChildOrdersView.vue'),
+      meta: { title: 'سفارش مشتریان', layout: 'FullPage', requiresAuth: true, requiresExpert: true },
+    },
+    {
+      path: '/customerChoice',
+      name: 'customerChoice',
+      component: () => import('../views/expert/CustomerChoiceView.vue'),
+      meta: { title: 'انتخاب مشتری', layout: 'FullPage', requiresAuth: true, requiresExpert: true },
+    },
     { path: '/notifications', name: 'notifications', component: () => import('../views/user/NotificationsView.vue') },
     { path: '/search', name: 'search', component: () => import('../views/search/SearchView.vue') },
     { path: '/collection/:id?', name: 'collection', component: () => import('../views/search/CollectionView.vue') },
@@ -60,6 +76,13 @@ router.beforeEach((to) => {
     return { name: 'login', query: { redirect: to.fullPath } };
   }
 
+  // D21 — an ordinary customer typing the URL is sent back to their
+  // dashboard. This is convenience, not security: the server refuses both
+  // expert endpoints for a non-expert token regardless of what the app does.
+  if (to.meta.requiresExpert && !session.isSalesExpert) {
+    return { name: 'userPage::hasSubRoute' };
+  }
+
   // legacy router/index.ts:268-270 — the product page slides down into view.
   if (to.name === 'singleProduct') nav.setPgaTransition('slideDown');
   else nav.setPgaTransition(undefined);