A cashier could hold only one open drawer across the whole academy, and the
three screens that ask about it did not agree on which one. Opening a shift
checked every branch (withoutBranchScope), while the POS terminal and the
manage screen looked only at the branch being worked in. So a drawer left open
at one branch locked every other branch out of selling: the terminal said "open
a shift first", the open form answered "there is already one open", and the
manage screen offered nothing to close, because the shift it was refusing over
was in a branch that screen will not show. On OC-Sport three accounts had
drawers open at ZSC since July, which is every account the other seven branches
sell through.

A drawer is a physical box standing in one branch — its float, its cash in and
its variance at close all belong to that branch's reconciliation, and
POSService already refuses to ring a sale against another branch's session. So
the invariant it can actually carry is one open drawer per cashier per branch,
which is also what the desks need: each branch opens its own shift and collects
normally, and closing one is never a precondition for another.

Also fixed, because more than one session per user can now be open at once:

- getOpenSession() resolves a named branch through forBranch() rather than
  filtering on top of the request scope. RefundService asks it for the drawer of
  the branch whose money is going back out; from any other branch that returned
  null and the refund silently skipped the cash count.
- UpdateCashSessionTotals prefers the drawer the payment names, and narrows its
  fallback to the payment's own branch. It runs on a queue where the branch
  scope is off, so an unqualified first() would have counted one branch's cash
  into another branch's box.
- Both screens now name the branches where the cashier still has a drawer open,
  so "there is already an open shift" is something the desk can act on.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>