feat(clerk): add dedicated nav pages, state restore, and fullscreen ESC fix

- Add ClerkUiStateService with full account state save/restore (no double network call on back navigation)
- Add Photo & Signature, Standing Instructions, Today's Activity as dedicated nav pages
- Remove photo/signature, standing instructions, linked accounts, today's activity panels from main dashboard
- Add ESC key to exit fullscreen; clicking Clerk nav immediately restores fullscreen without re-navigating
- Compact clerk dashboard UI with reduced font sizes and padding throughout
- Add CashierOnlyGuard for route protection

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app/core/authentication/authentication.service.ts

@@ -388,6 +388,14 @@ export class AuthenticationService {
     return JSON.parse(this.storage.getItem(this.credentialsStorageKey));
   }
 
+  /** Returns true when the logged-in user has the "Clerk" role. */
+  isClerkUser(): boolean {
+    const creds = this.getCredentials();
+    if (!creds || !creds.roles) return false;
+    const roleNames: string[] = (creds.roles as any[]).map((r) => (r.name || r.role || '').toLowerCase().trim());
+    return roleNames.some((n) => n === 'clerk');
+  }
+
   /**
    * Returns true ONLY for regular cashier role (not Head Cashier).
    * Regular cashier → full-screen transaction entry, no nav.

src/app/core/authentication/cashier-only.guard.ts

@@ -0,0 +1,29 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { Injectable, inject } from '@angular/core';
+import { Router } from '@angular/router';
+import { AuthenticationService } from './authentication.service';
+
+/**
+ * Restricts /cashier/transaction-entry to users with the Cashier role only.
+ * Clerk and other roles are redirected to /home.
+ */
+@Injectable({ providedIn: 'root' })
+export class CashierOnlyGuard {
+  private router = inject(Router);
+  private authService = inject(AuthenticationService);
+
+  canActivate(): boolean {
+    if (this.authService.isCashierUser()) {
+      return true;
+    }
+    this.router.navigate(['/home'], { replaceUrl: true });
+    return false;
+  }
+}