feat(cashier,organization): denomination-aware vault UI, Bank/Branch Profile screens, popup disbursement review

Branch Day open/close now captures a denomination-wise count (carried
forward automatically to the next day), and shows an auto-fetched EOD
summary at close time -- vault + every cashier's position, a branch-total
reconciliation against the book figure, and each cashier's
reconciliation/settlement status and transaction count -- so closing the day
no longer means separately checking Vault Position and every cashier's own
screen by hand. New Vault Position screen (branch-ops menu) mirrors Cashier
Position for the teller/vault. Cash Transfer now shows the vault's live
per-denomination availability while counting a handout, with a client-side
warning before it can be over-counted.

New Organization screens for Bank Profile, Branch Profile and Clearing GL
Configuration, wired into the Organization landing page and the
previously-dead "Bank Profile" admin menu button.

Cashier Transaction Entry: TYPE is now Receipt/Payment only (cash-only TXN
TP.) on the cashier side, with no change to the clerk dashboard's own
Withdrawal Slip/Cheque/Disbursement/Enter Bank Transfer/DD flow beyond
adding a new Fund Transfer type alongside Disbursement for a GL credit that
isn't a loan payout. Neither TYPE nor TXN TP. offers a blank placeholder
option anymore -- a new row starts on a real default instead. Footer no
longer polls the business-date config for cashier/clerk roles, who never
have permission to read it.

Disbursement & Transfer Requests: "Review" now opens the review screen as a
popup instead of navigating to a separate route, refreshing the list on
close; the review screen recognises the new Fund Transfer request type
too, and its non-functional "+ Disbursement Review" tab-styled label is now
a plain heading.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/shared/footer/footer.component.ts

@@ -182,12 +182,16 @@ export class FooterComponent implements OnInit, OnDestroy {
    * Get the Configuration for Business Date
    */
   getConfigurations(): void {
-    if (this.authenticationService.isAuthenticated()) {
-      // Reading global configuration needs the READ_CONFIGURATION permission, which teller-style
-      // roles (cashier, clerk) do not carry. This runs from the footer on every authenticated
-      // page, so an unpermitted role was greeted by an "Unauthorized Request" modal at login for
-      // a check it never asked for. The footer only uses this to decide whether to show a
-      // business date, so a denied read is not an error here — it degrades to the system date.
+    // Reading global configuration needs the READ_CONFIGURATION permission, which teller-style
+    // roles (cashier, clerk) never carry by design — the read would always come back 403. The
+    // footer only uses this to decide whether to show a business date, so a role that can never
+    // read it just never asks, instead of round-tripping a request every page load (and every
+    // 60s poll while a day is open) purely to have it rejected.
+    if (
+      this.authenticationService.isAuthenticated() &&
+      !this.authenticationService.isCashierUser() &&
+      !this.authenticationService.isClerkUser()
+    ) {
       this.systemService.getConfigurationByName(SettingsService.businessDateConfigName, true).subscribe({
         next: (configurationData: any) => {
           this.isBusinessDateEnabled = configurationData.enabled;