EHSAN official look & auth (Task #5)

Reskin the EHSAN POC to match ehsan.sa and gate the admin area behind a
simple POC login.

- Official header: cropped EHSAN logo, nav (الرئيسية/الوقف/فرص التبرع/
  خدماتنا dropdown→طلب دعم/عن إحسان/براعم إحسان), login/cart/search icons,
  language toggle, mobile menu. Functional items link; rest are visual-only.
- Colors: green primary tuned + orange accent token added in index.css.
- Auth: AuthContext (localStorage, admin/admin) + login page; /admin and
  /whatsapp-log now behind a Protected wrapper redirecting to /login.
- Redesigned OpportunityCard (photo, green progress bar with %, category
  badge, تم جمع/المبلغ المتبقي columns, inline donate button + amount),
  used on home and opportunities pages.
- Two-step donate page (التفاصيل → الدفع): step indicator, presets
  100/50/10, custom amount (prefilled via ?amount=), "تبرع عن أهلك"
  checkbox, donor form (phone min 10 for OpenClaw loop).
- 8 need-type card images added; needImages helper maps need→image.
- Seed: added published opportunities (req-012..017) with partial progress
  to showcase cards; one kept near-full for an easy closed-loop demo.

Deviation (from code review): donate handler now ACCUMULATES collectedAmount
and clamps to target, validates finite/positive amount, and only advances to
the closed-loop pipeline when a case is fully funded (previously overwrote
and force-advanced — broke partial-progress cases). Donate buttons kept green
to match the reference; orange is an accent only.

artifacts/api-server/src/routes/requests.ts

@@ -165,15 +165,30 @@ router.post("/requests/:id/donate", (req: Request, res: Response): void => {
   }
 
   const { donorName, donorPhone, donorEmail, amount } = req.body;
-  if (!donorName || !donorPhone || !amount) {
-    res.status(400).json({ error: "Missing donor details" });
+  const amt = Number(amount);
+  if (!donorName || !donorPhone || !Number.isFinite(amt) || amt <= 0) {
+    res.status(400).json({ error: "Invalid donor details or amount" });
     return;
   }
 
+  if (item.status !== "published") {
+    res.status(400).json({ error: "Case is not open for donations" });
+    return;
+  }
+
+  const remaining = Math.max(0, item.requestedAmount - item.collectedAmount);
+  if (remaining <= 0) {
+    res.status(400).json({ error: "Case already fully funded" });
+    return;
+  }
+
+  // Clamp the donation so the collected amount never exceeds the target.
+  const applied = Math.min(amt, remaining);
+
   const donorId = uuidv4();
   const existingDonor = donors.find((d) => d.phone === donorPhone);
   if (existingDonor) {
-    existingDonor.totalDonated += Number(amount);
+    existingDonor.totalDonated += applied;
     existingDonor.donationCount += 1;
     item.donorId = existingDonor.id;
   } else {
@@ -182,7 +197,7 @@ router.post("/requests/:id/donate", (req: Request, res: Response): void => {
       name: donorName,
       phone: donorPhone,
       email: donorEmail || null,
-      totalDonated: Number(amount),
+      totalDonated: applied,
       donationCount: 1,
     };
     donors.push(newDonor);
@@ -190,9 +205,13 @@ router.post("/requests/:id/donate", (req: Request, res: Response): void => {
   }
 
   item.donorName = donorName;
-  item.collectedAmount = Number(amount);
-  item.status = "donated";
-  item.currentStep = STATUS_STEP["donated"];
+  item.collectedAmount += applied;
+
+  // Only advance into the closed-loop pipeline once the case is fully funded.
+  if (item.collectedAmount >= item.requestedAmount) {
+    item.status = "donated";
+    item.currentStep = STATUS_STEP["donated"];
+  }
   item.updatedAt = new Date().toISOString();
   res.json(item);
 });