F-201: GET /pos/reports/cash-close/:id with financial summary, sales
by state, payments breakdown, items sold. Extended /pos/sessions/:id.
F-202: Cash close email sent on session close to smtpReportEmail
(best-effort). smtpReportEmail field added to admin SMTP settings.
F-203: Admin POS terminal config: selfpayMode, closeSessionRequiresPin,
closeSessionPin (4-6 digits) with dedicated settings section.
- users module: profile + address CRUD behind use cases (users_profiles,
users_addresses)
- roles customer/admin on identity_users; role resolved from DB per request
- shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin)
injected from composition root; users never imports identity
- authorization runs before existence checks; address SQL scoped by user_id
- @fastify/cookie registered once at app root (cross-module)
- migrations 003_identity_roles + 004_users (reversible)
- no new npm dependencies; tests: unit 52, integration 22
Gates: reviewer/security/qa APPROVED; verify.sh green
- node-pg-migrate + pg: baseline migration (extensions, app_meta) with working down
- src/infrastructure/db fail-fast pool and typed query helper
- docker-compose: postgres:16-alpine + redis:7-alpine with one-command up
- table naming convention <module>_<table> documented in README
- integration tests (6) against real PostgreSQL; strict identifier validation
for test DDL after security-gate hardening round
- deps justified in spec/tech.md; all gates approved; verify.sh green
