West Coast Pest - production login/session engine fix

Install:
1. Upload this ZIP to /home/uent/public_html/
2. Extract there and overwrite files.
3. Close/reopen the phone app. If it is installed as a PWA and still shows old behaviour, remove and reinstall the PWA once.

What changed:
- Login uses Email or phone number.
- Frontend sends identifier, not email-only.
- Backend accepts email or South African phone formats: 079..., +2779..., 2779..., 002779...
- Session state uses clock_out_time IS NULL as the only source of truth.
- Previous-day open sessions are auto-closed.
- Duplicate open sessions for the same user are closed down to the latest one.
- Clock-out closes the latest open session.
- Start Working Lunch / End Working Lunch is preserved.
- Working lunch also writes a legacy WORKING_LUNCH marker so existing reports still stop the lunch deduction.

No SQL changes are required.
