Session lock + phone login fix

Upload/extract inside /home/uent/public_html/ and overwrite.

Fixes:
- Staff app login accepts email OR phone number.
- South African phone formats are matched by last 9 digits, so 0791900505 and +27791900505 both work.
- Session state uses clock_out_time IS NULL as the source of truth.
- Before loading staff state, stale previous-day open sessions are auto-closed and duplicate open sessions for that user are reduced to the latest session.
- Clock Out uses the latest open session by clock_out_time IS NULL.
- PWA cache version is bumped.

After upload, close/reopen the PWA. If it still shows old buttons, remove and reinstall the PWA once.
