feat(apps): sales-expert screens in both apps + v2 admin home slider (D21, APP-02)

Both expert screens are built in user-app and user-app-v2, with byte-identical
template and script and a per-app style block only — verified by diffing
everything above <style>:

  ChildOrdersView  "سفارش مشتریان"  — legacy ChildOrders.vue. Keeps the
    reference's title, search, infinite paging, and per-card item count, total
    weight, customer name and the fixed «تحویل مسئول فروش» chip (the endpoint
    only returns that status, ApiMobileController:766).
  CustomerChoiceView "لیست مشتریان" — legacy customerChoice.vue. Keeps its
    title, per-search re-query and the reference's choice to LIST inactive
    customers (its active() scope is commented out at :187).

Reachable from inside the app, not just by URL: routes carry the reference's own
paths and names, the dashboard grows the two entries only for an expert (v1 as
tiles, v2 as its own rows), and a router guard sends an ordinary customer back
to their dashboard. None of that is relied on for safety — the server scopes
both endpoints on the AdminUser id in the token and answers 403 otherwise.

Not ported, both recorded in D21: the act-as api_token minting (:197-201) and
the child-order edit drawer, which recomputed an order's money from client-sent
values. The card opens a read-only summary instead.

APP-02 fixed: user-app-v2 gained getHomeSlider and now prefers admin-configured
slides, keeping its category-derived hero as the fallback and its own design.

Session stores stay byte-identical across the apps.
build 5/5, jest 45/45, expert login 36/36, apps smoke 43/43, typecheck clean.

[ref: henza_pwa/src/views/user/src/components/ChildOrders.vue, customerChoice.vue]
[ref: henza_pwa/src/router/index.ts:171-188]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/user-app/src/stores/session.ts

@@ -5,6 +5,8 @@ const CUSTOMER_ID_KEY = 'gold-bank:customerId';
 const MOBILE_KEY = 'gold-bank:mobile';
 /** Legacy's isUserLoggedIn() (Mixins/checkAccess.ts) reads this key. */
 const LEGACY_FLAG_KEY = 'appToken';
+/** D21 — cached so the expert menu entries render before whoami resolves. */
+const EXPERT_KEY = 'gold-bank:isSalesExpert';
 
 /**
  * The logged-in customer's session.
@@ -25,6 +27,15 @@ export const useSessionStore = defineStore('session', {
     token: localStorage.getItem(TOKEN_KEY) as string | null,
     customerId: localStorage.getItem(CUSTOMER_ID_KEY) as string | null,
     mobile: localStorage.getItem(MOBILE_KEY) as string | null,
+    /**
+     * D21 — whether this session belongs to a sales expert.
+     *
+     * A CONVENIENCE ONLY: it decides whether the two expert entries are
+     * rendered. It is never an authorisation claim — the server scopes both
+     * expert routes on the AdminUser id inside the token and answers 403 for
+     * an ordinary customer, so flipping this in devtools reveals nothing.
+     */
+    isSalesExpert: localStorage.getItem(EXPERT_KEY) === '1',
   }),
   getters: {
     /** Authenticated means holding a token, not merely knowing an id. */
@@ -40,6 +51,13 @@ export const useSessionStore = defineStore('session', {
       localStorage.setItem(MOBILE_KEY, mobile);
       localStorage.setItem(LEGACY_FLAG_KEY, token);
     },
+
+    /** Set from GET /expert/whoami right after login. */
+    setSalesExpert(value: boolean) {
+      this.isSalesExpert = value;
+      if (value) localStorage.setItem(EXPERT_KEY, '1');
+      else localStorage.removeItem(EXPERT_KEY);
+    },
     /**
      * Clears everything. Called on explicit logout and by the API client when a
      * request comes back 401 — an expired or revoked token must not leave stale
@@ -49,6 +67,8 @@ export const useSessionStore = defineStore('session', {
       this.token = null;
       this.customerId = null;
       this.mobile = null;
+      this.isSalesExpert = false;
+      localStorage.removeItem(EXPERT_KEY);
       localStorage.removeItem(TOKEN_KEY);
       localStorage.removeItem(CUSTOMER_ID_KEY);
       localStorage.removeItem(MOBILE_KEY);