Enforce tenant isolation in the data layer instead of per route

Every route had to remember to add the business filter to every query;
nothing stopped one that forgot. The audit for this change found several
that had: the M-Pesa status re-check, the stock ledger's duplicate checks,
the daily-inventory and branch-price upserts, a cash-sale replay lookup,
several load-by-id lookups, and every populate().

- tenantGuard: a Mongoose plugin on all ten business-scoped models. Any
  find/update/delete/count/distinct, or an aggregate whose first stage is
  not a $match, that does not pin exactly one businessId throws
  TenantScopeError before reaching the database ($in, $exists and other
  operators do not count).
- crossTenant("reason", fn): the explicit, documented exemption for the
  queries that must span businesses - login's email lookup, refresh and
  invite-token lookups, the M-Pesa callback, the platform console and the
  maintenance scripts. git grep crossTenant lists them all.
- scopedPopulate: populated branch, product and staff names are also
  restricted to the business.
- Every flagged query site now names the business (or is exempted with a
  reason).
- Tests: a check that every model with a businessId field carries the
  guard; the guard refusing unscoped queries of every kind; and a route
  sweep where business A sends business B's ids to every read route
  (nothing of B's comes back) and every write route (all refused, B's
  data unchanged). Test-side database inspections go through db(), an
  explicit test exemption. Removing one route's business filter makes the
  suite fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/sync.test.ts

@@ -4,7 +4,7 @@ import { Product, BranchPricing } from "@/lib/server/models/Product";
 import { stockOf } from "@/lib/server/stock";
 import * as cash from "@/app/api/transactions/cash/route";
 import type { SaleResult } from "@/lib/syncProtocol";
-import { json, makeTenant, req, uuid, type Actor, type Tenant } from "./helpers";
+import { json, makeTenant, req, uuid, type Actor, type Tenant, db } from "./helpers";
 
 function sale(t: Tenant, cashier: Actor, lines: { productId: string; quantity: number; unitPrice?: number }[], extra = {}) {
   return {
@@ -31,7 +31,7 @@ describe("offline sale sync", () => {
     const { status, body } = await post(t.cashierA, [s]);
     expect(status).toBe(200);
     expect(body.results).toEqual([{ clientUuid: s.clientUuid, status: "saved", amountTotal: 580, priceMismatch: false }]);
-    expect(await Transaction.countDocuments({ saleId: s.clientUuid })).toBe(2);
+    expect(await db(() => Transaction.countDocuments({ saleId: s.clientUuid }))).toBe(2);
     expect(await stockOf(t.businessId, t.branchA, t.water20)).toBe(-2);
     expect(await stockOf(t.businessId, t.branchA, t.water5)).toBe(-3);
   });
@@ -42,7 +42,7 @@ describe("offline sale sync", () => {
     await post(t.cashierA, [s]);
     const replay = await post(t.cashierA, [s]);
     expect(replay.body.results[0]).toMatchObject({ clientUuid: s.clientUuid, status: "duplicate" });
-    expect(await Transaction.countDocuments({ saleId: s.clientUuid })).toBe(1);
+    expect(await db(() => Transaction.countDocuments({ saleId: s.clientUuid }))).toBe(1);
     expect(await stockOf(t.businessId, t.branchA, t.water20)).toBe(-1);
   });
 
@@ -78,7 +78,7 @@ describe("offline sale sync", () => {
     const otherCashiersSale = sale(t, t.cashierB, [{ productId: t.water20, quantity: 1 }]);
     const { body } = await post(t.cashierA, [otherCashiersSale]);
     expect(body.results[0].status).toBe("rejected");
-    expect(await Transaction.countDocuments({})).toBe(0);
+    expect(await db(() => Transaction.countDocuments({}))).toBe(0);
   });
 
   it("keeps a sale at the branch where it happened after the cashier is moved", async () => {
@@ -86,7 +86,7 @@ describe("offline sale sync", () => {
     const s = sale(t, t.cashierA, [{ productId: t.water20, quantity: 1 }]); // recorded at branch A
     const moved = { ...t.cashierA, branchId: t.branchB };
     await post(moved, [s]);
-    const txn = await Transaction.findOne({ saleId: s.clientUuid });
+    const txn = await db(() => Transaction.findOne({ saleId: s.clientUuid }));
     expect(txn!.branchId.toString()).toBe(t.branchA);
   });
 
@@ -97,13 +97,13 @@ describe("offline sale sync", () => {
     const foreignBranch = sale(t, t.cashierA, [{ productId: t.water20, quantity: 1 }], { branchId: other.branchA });
     const { body } = await post(t.cashierA, [foreignProduct, foreignBranch]);
     expect(body.results.map((r) => r.status)).toEqual(["rejected", "rejected"]);
-    expect(await Transaction.countDocuments({})).toBe(0);
+    expect(await db(() => Transaction.countDocuments({}))).toBe(0);
   });
 
   it("uses the branch price, flags a price the device showed differently, and keeps deactivated products sellable", async () => {
     const t = await makeTenant();
     await BranchPricing.create({ businessId: t.businessId, branchId: t.branchA, productId: t.water20, unitPrice: 180 });
-    await Product.updateOne({ _id: t.water5 }, { isActive: false });
+    await db(() => Product.updateOne({ _id: t.water5 }, { isActive: false }));
     const s = sale(t, t.cashierA, [
       { productId: t.water20, quantity: 1, unitPrice: 200 }, // stale price on the device
       { productId: t.water5, quantity: 1, unitPrice: 60 },