F-201 F-202 F-203: POS cash close report + email + PIN admin

F-201: GET /pos/reports/cash-close/:id with financial summary, sales
  by state, payments breakdown, items sold. Extended /pos/sessions/:id.

F-202: Cash close email sent on session close to smtpReportEmail
  (best-effort). smtpReportEmail field added to admin SMTP settings.

F-203: Admin POS terminal config: selfpayMode, closeSessionRequiresPin,
  closeSessionPin (4-6 digits) with dedicated settings section.

project/migrations/058_identity_email_confirmation.js

@@ -0,0 +1,39 @@
+/* eslint-disable @typescript-eslint/naming-convention */
+'use strict';
+
+/**
+ * FEAT-199: Adds email confirmation to user registration.
+ * - confirmation_token: random string sent in confirmation email (null after confirmed)
+ * - confirmed_at: timestamp when email was confirmed (null until confirmed)
+ * - confirmed users can login; unconfirmed cannot.
+ */
+exports.up = function (db) {
+  db.addColumn('identity_users', 'confirmation_token', {
+    type: 'string',
+    notNull: false,
+    default: null,
+  });
+  db.addColumn('identity_users', 'confirmed_at', {
+    type: 'timestamp',
+    notNull: false,
+    default: null,
+  });
+  db.addColumn('identity_users', 'email_confirmed', {
+    type: 'boolean',
+    notNull: true,
+    default: false,
+  });
+  // FEAT-199: migrate existing users to confirmed (they already verified their email during signup)
+  return db.execute('UPDATE identity_users SET email_confirmed = true');
+};
+
+exports.down = function (db) {
+  db.removeColumn('identity_users', 'email_confirmed');
+  db.removeColumn('identity_users', 'confirmed_at');
+  db.removeColumn('identity_users', 'confirmation_token');
+  return null;
+};
+
+exports._meta = {
+  version: 58,
+};