fix(api): close M5 frontend contract gaps

backend/unified-api/scripts/live-smoke-v2-unified.mjs

@@ -343,6 +343,12 @@ async function main() {
     token: ownerSession.sessionToken,
   });
   assert.ok(Array.isArray(coverage.items));
+  const seededCoverageShift = coverage.items.find((item) => item.shiftId === fixture.shifts.assigned.id) || coverage.items[0];
+  assert.ok(seededCoverageShift);
+  assert.ok(seededCoverageShift.locationName);
+  if (seededCoverageShift.assignedWorkers?.[0]) {
+    assert.equal(typeof seededCoverageShift.assignedWorkers[0].hasReview, 'boolean');
+  }
   logStep('client.coverage.ok', { count: coverage.items.length });
 
   const coverageStats = await apiCall(`/client/coverage/stats?date=${isoDate(0)}`, {
@@ -753,6 +759,13 @@ async function main() {
   });
   logStep('staff.profile-completion.ok', staffProfileCompletion);
 
+  const staffProfileStats = await apiCall('/staff/profile/stats', {
+    token: staffAuth.idToken,
+  });
+  assert.equal(typeof staffProfileStats.totalShifts, 'number');
+  assert.equal(typeof staffProfileStats.reliabilityScore, 'number');
+  logStep('staff.profile.stats.ok', staffProfileStats);
+
   const staffAvailability = await apiCall('/staff/availability', {
     token: staffAuth.idToken,
   });
@@ -1129,6 +1142,28 @@ async function main() {
   assert.ok(clockIn.securityProofId);
   logStep('staff.clock-in.ok', clockIn);
 
+  const duplicateClockIn = await apiCall('/staff/clock-in', {
+    method: 'POST',
+    token: staffAuth.idToken,
+    idempotencyKey: uniqueKey('staff-clock-in-duplicate'),
+    body: {
+      shiftId: fixture.shifts.assigned.id,
+      sourceType: 'GEO',
+      deviceId: 'smoke-iphone-15-pro',
+      latitude: fixture.clockPoint.latitude,
+      longitude: fixture.clockPoint.longitude,
+      accuracyMeters: 8,
+      proofNonce: uniqueKey('geo-proof-clock-in-duplicate'),
+      proofTimestamp: isoTimestamp(0),
+      capturedAt: isoTimestamp(0),
+    },
+    expectedStatus: 409,
+    allowFailure: true,
+  });
+  assert.equal(duplicateClockIn.statusCode, 409);
+  assert.equal(duplicateClockIn.body.code, 'ALREADY_CLOCKED_IN');
+  logStep('staff.clock-in.duplicate.ok', duplicateClockIn.body);
+
   const attendanceStatusAfterClockIn = await apiCall('/staff/clock-in/status', {
     token: staffAuth.idToken,
   });