NFC ONE FINAL LOGIN + EMAIL RECOVERY + RECEIPT UPGRADE

Includes:
- Receipt footer: Goods once sold cannot be refunded.
- View/hide icons on username, password and password-change fields.
- Forgot username by registered employee email.
- Forgot password by registered employee email with single-use 30-minute reset link.
- First-login/Owner-reset mandatory password change.
- Employee email field in Owner -> Employees.
- Owner reset notification email when an employee has a registered email.
- Password-change confirmation email.
- Existing branding, dashboard colours, Products + Services, employee actions, receipts and reports preserved.

DEPLOYMENT:
1. Back up current production index.html, app.js and api_core.php.
2. The database columns email, password_reset_token_hash, password_reset_expires_at and must_change_password should already exist from the earlier SQL steps. Do not re-run duplicate ALTER TABLE statements.
3. Replace ONLY index.html, app.js, api_core.php and nfc_logo.png in the public folder. Do NOT replace index.php or config.php.
4. Ensure private/config.php contains the SMTP constants configured for noreply@nimyfixturescentre.co.ke. Keep the SMTP password private.
5. Ctrl+F5 and test.

EMAIL RECOVERY:
- Employee must have a valid email stored in Owner -> Employees.
- Forgot username emails the username.
- Forgot password emails a 30-minute single-use reset link.
- The application never emails the current password.
- Recovery responses are intentionally generic.

IMPORTANT:
This adds the employee email field to NFC ONE. It does not automatically create a physical cPanel mailbox. Actual mailbox creation remains a cPanel email-account task unless a separate cPanel API integration is added later.
