Enforce tenant isolation in the data layer instead of per route

Every route had to remember to add the business filter to every query;
nothing stopped one that forgot. The audit for this change found several
that had: the M-Pesa status re-check, the stock ledger's duplicate checks,
the daily-inventory and branch-price upserts, a cash-sale replay lookup,
several load-by-id lookups, and every populate().

- tenantGuard: a Mongoose plugin on all ten business-scoped models. Any
  find/update/delete/count/distinct, or an aggregate whose first stage is
  not a $match, that does not pin exactly one businessId throws
  TenantScopeError before reaching the database ($in, $exists and other
  operators do not count).
- crossTenant("reason", fn): the explicit, documented exemption for the
  queries that must span businesses - login's email lookup, refresh and
  invite-token lookups, the M-Pesa callback, the platform console and the
  maintenance scripts. git grep crossTenant lists them all.
- scopedPopulate: populated branch, product and staff names are also
  restricted to the business.
- Every flagged query site now names the business (or is exempted with a
  reason).
- Tests: a check that every model with a businessId field carries the
  guard; the guard refusing unscoped queries of every kind; and a route
  sweep where business A sends business B's ids to every read route
  (nothing of B's comes back) and every write route (all refused, B's
  data unchanged). Test-side database inspections go through db(), an
  explicit test exemption. Removing one route's business filter makes the
  suite fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/branchPrices.test.ts

@@ -4,7 +4,7 @@ import { BranchPricing } from "@/lib/server/models/Product";
 import * as prices from "@/app/api/branch-prices/route";
 import * as products from "@/app/api/products/route";
 import * as cash from "@/app/api/transactions/cash/route";
-import { json, makeTenant, req, uuid, type Actor, type Tenant } from "./helpers";
+import { json, makeTenant, req, uuid, type Actor, type Tenant, db } from "./helpers";
 
 const setPrice = (as: Actor, branchId: string, productId: string, unitPrice: number) =>
   prices.PUT(req("PUT", "/api/branch-prices", { as, body: { branchId, productId, unitPrice } }));
@@ -44,7 +44,7 @@ describe("branch prices", () => {
     const t = await makeTenant();
     await setPrice(t.owner, t.branchA, t.water20, 180);
     await setPrice(t.owner, t.branchA, t.water20, 200);
-    expect(await BranchPricing.countDocuments({})).toBe(0);
+    expect(await db(() => BranchPricing.countDocuments({}))).toBe(0);
 
     await setPrice(t.owner, t.branchA, t.water5, 55);
     const reset = await prices.DELETE(
@@ -85,6 +85,6 @@ describe("branch prices", () => {
     expect((await setPrice(t.owner, other.branchA, t.water20, 150)).status).toBe(404);
     expect((await setPrice(t.owner, t.branchA, other.water20, 150)).status).toBe(404);
     expect((await prices.GET(req("GET", "/api/branch-prices?branchId=" + other.branchA, { as: t.owner }))).status).toBe(404);
-    expect(await BranchPricing.countDocuments({})).toBe(0);
+    expect(await db(() => BranchPricing.countDocuments({}))).toBe(0);
   });
 });