F-201 F-202 F-203: POS cash close report + email + PIN admin

F-201: GET /pos/reports/cash-close/:id with financial summary, sales
  by state, payments breakdown, items sold. Extended /pos/sessions/:id.

F-202: Cash close email sent on session close to smtpReportEmail
  (best-effort). smtpReportEmail field added to admin SMTP settings.

F-203: Admin POS terminal config: selfpayMode, closeSessionRequiresPin,
  closeSessionPin (4-6 digits) with dedicated settings section.

work/artifacts/FIX-196/implementer.md

@@ -0,0 +1,16 @@
+# FIX-196 — Controlled→uncontrolled input warning in CheckoutClient
+
+## Fix
+`addressToForm()` assigns `addr.postalCode` and `addr.country` directly. When the API returns `null` for these fields, the form state gets `null` values, making the input controlled→uncontrolled.
+
+## Change
+`project/frontend/src/components/checkout/CheckoutClient.tsx` line 48-49:
+```diff
+- postalCode: addr.postalCode,
+- country: addr.country,
++ postalCode: addr.postalCode ?? '',
++ country: addr.country ?? '',
+```
+
+## Verification
+- `npx tsc --noEmit` (frontend): 0 errors