feat: mid-shift X-report (read-only takings-so-far)

Let the operator see, on demand during an open shift, the opening float
inherited, cash/card collected so far, pay-ins/pay-outs, and the current
expected drawer balance — without closing.

GET /api/shift/report (shift:read; 204 when no shift is open) returns the same
drawer projection the Z-report computes. Factored that math into a shared
ShiftService.#summariseWindow(open, asOf) used by BOTH the X-report (asOf=now,
read-only) and close()'s Z-report (asOf=endedAt, signed), so the two can't
drift. The X-report appends NOTHING — it's a snapshot, not an accountability
mark; the Z-report at close remains the signed record.

UI: a "Takings so far" button on the shift control reveals a cyan X-report
panel; the header still shows the live drawer total for the at-a-glance figure.

Verified against a copy of the live DB: X figures match drawerBalance(), the
drawer identity holds, zero events appended, chain still verifies.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/web/src/api.ts

@@ -627,6 +627,29 @@ export function closeShift(): Promise<ShiftReport> {
   return apiFetch("/api/shift/close", { method: "POST" });
 }
 
+/** Mid-shift X-report: the open shift's takings + drawer "so far" (read-only — no
+ *  event is appended). Same figures the Z-report will print at close. `asOf` is the
+ *  snapshot instant. */
+export interface XReport {
+  operator: string;
+  startedAt: string;
+  endedAt: string; // = asOf
+  asOf: string;
+  cashTotalMinor: number;
+  cardTotalMinor: number;
+  currency: string | null;
+  paymentCount: number;
+  openingFloatMinor: number;
+  cashAddedMinor: number;
+  cashRemovedMinor: number;
+  expectedDrawerMinor: number;
+}
+
+/** Fetch the mid-shift X-report; resolves to null when no shift is open (204). */
+export async function fetchShiftReport(): Promise<XReport | null> {
+  return (await apiFetch<XReport | undefined>("/api/shift/report")) ?? null;
+}
+
 /** A drawer cash voucher: Mandat Arkëtimi (cash_in / pay-IN) or Mandat Pagese
  *  (cash_out / pay-OUT). Direction is the TYPE, amountMinor a positive magnitude.
  *  Operator-raised, admin-authorized (authorizedBy + their password). */