Enforce tenant isolation in the data layer instead of per route

Every route had to remember to add the business filter to every query;
nothing stopped one that forgot. The audit for this change found several
that had: the M-Pesa status re-check, the stock ledger's duplicate checks,
the daily-inventory and branch-price upserts, a cash-sale replay lookup,
several load-by-id lookups, and every populate().

- tenantGuard: a Mongoose plugin on all ten business-scoped models. Any
  find/update/delete/count/distinct, or an aggregate whose first stage is
  not a $match, that does not pin exactly one businessId throws
  TenantScopeError before reaching the database ($in, $exists and other
  operators do not count).
- crossTenant("reason", fn): the explicit, documented exemption for the
  queries that must span businesses - login's email lookup, refresh and
  invite-token lookups, the M-Pesa callback, the platform console and the
  maintenance scripts. git grep crossTenant lists them all.
- scopedPopulate: populated branch, product and staff names are also
  restricted to the business.
- Every flagged query site now names the business (or is exempted with a
  reason).
- Tests: a check that every model with a businessId field carries the
  guard; the guard refusing unscoped queries of every kind; and a route
  sweep where business A sends business B's ids to every read route
  (nothing of B's comes back) and every write route (all refused, B's
  data unchanged). Test-side database inspections go through db(), an
  explicit test exemption. Removing one route's business filter makes the
  suite fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/access.test.ts

@@ -15,7 +15,7 @@ import * as login from "@/app/api/auth/login/route";
 import * as signup from "@/app/api/auth/signup/route";
 import * as stkpush from "@/app/api/mpesa/stkpush/route";
 import * as callback from "@/app/api/mpesa/callback/route";
-import { json, makeTenant, params, req, uuid } from "./helpers";
+import { json, makeTenant, params, req, uuid, db } from "./helpers";
 
 describe("role-based access on the backend", () => {
   it("blocks cashiers from owner-level money endpoints with 403", async () => {
@@ -78,7 +78,7 @@ describe("user deactivation", () => {
       params({ id: t.cashierA.id })
     );
     expect(res.status).toBe(200);
-    expect((await User.findById(t.cashierA.id))!.isActive).toBe(false);
+    expect((await db(() => User.findById(t.cashierA.id)))!.isActive).toBe(false);
     expect(await UserSession.countDocuments({ userId: t.cashierA.id })).toBe(0);
   });
 
@@ -105,7 +105,7 @@ describe("tenant status", () => {
   it("refuses login for a suspended business", async () => {
     const t = await makeTenant();
     const passwordHash = await bcrypt.hash("correct-horse", 4);
-    await User.updateOne({ _id: t.cashierA.id }, { passwordHash });
+    await db(() => User.updateOne({ _id: t.cashierA.id }, { passwordHash }));
     await Business.updateOne({ _id: t.businessId }, { subscriptionStatus: "SUSPENDED" });
 
     const res = await login.POST(
@@ -119,7 +119,7 @@ describe("tenant status", () => {
   it("still allows login for an active business", async () => {
     const t = await makeTenant();
     const passwordHash = await bcrypt.hash("correct-horse", 4);
-    await User.updateOne({ _id: t.managerA.id }, { passwordHash });
+    await db(() => User.updateOne({ _id: t.managerA.id }, { passwordHash }));
     const res = await login.POST(
       req("POST", "/api/auth/login", {
         body: { email: t.managerA.email, password: "correct-horse", deviceId: uuid() },