F-201 F-202 F-203: POS cash close report + email + PIN admin

F-201: GET /pos/reports/cash-close/:id with financial summary, sales
  by state, payments breakdown, items sold. Extended /pos/sessions/:id.

F-202: Cash close email sent on session close to smtpReportEmail
  (best-effort). smtpReportEmail field added to admin SMTP settings.

F-203: Admin POS terminal config: selfpayMode, closeSessionRequiresPin,
  closeSessionPin (4-6 digits) with dedicated settings section.

project/frontend/src/contexts/AuthContext.tsx

@@ -21,11 +21,14 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
   const [user, setUser] = useState<User | null>(null);
   const [loading, setLoading] = useState(true);
 
+  // FIX-198: must send credentials so the session cookie is included.
+  // FIX-198: /auth/me returns {id,email,role} when authenticated, {user:null} when not.
   useEffect(() => {
-    fetch('/api/auth/me')
+    fetch('/api/auth/me', { credentials: 'include' })
       .then((r) => r.json())
       .then((data) => {
-        setUser(data.user ?? null);
+        // When authenticated: { id, email, role }. When not: { user: null }.
+        setUser(data.user ?? (data.id ? data : null));
       })
       .catch(() => setUser(null))
       .finally(() => setLoading(false));