Enforce roles and tenant status on the server, and use the Kenyan business day

The admin pages redirected cashiers away, but the API itself let them read
profit, expenses and purchases and record expenses and purchases. Branch
managers could also change product prices for every branch. Every gated
route now goes through authorize(), which answers 401 when signed out and
403 for the wrong role.

- Owners and managers only: profit report, expenses, purchases, users,
  morning dispatch and evening count. Owner only: create and edit products,
  rename branches.
- PATCH /api/users/:id deactivates or reactivates staff (managers: their own
  cashiers only) and revokes the user's device sessions. PATCH
  /api/branches/:id renames a branch.
- Login and token refresh refuse inactive or SUSPENDED businesses.
- Public signup refuses PLATFORM_ADMIN_EMAILS addresses, so an unregistered
  operator email can no longer be claimed.
- M-Pesa sits behind FEATURE_MPESA (off by default, out of scope for the
  pilot): its routes return 404 and the Daraja variables are optional.
  Turning it on in production requires the callback IP allowlist.
- "Today" and the default month now follow Africa/Nairobi instead of the
  server's UTC clock, so the business day no longer starts at 03:00 EAT.
- Malformed ids in query strings and bodies return 400 instead of a 500,
  the inventory routes check the product belongs to the tenant, and the
  reconciliation lookups are tenant-scoped.
- Branch-scoped staff see their branch's override price from GET /api/products.
- Adds a vitest suite against an in-memory MongoDB (npm test).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/app/api/auth/login/route.ts

@@ -9,6 +9,7 @@ import { signAccessToken, generateRefreshToken, hashRefreshToken, refreshTtlMs }
 import { ACCESS_COOKIE, REFRESH_COOKIE, accessCookieOptions, refreshCookieOptions } from "@/lib/server/auth";
 import { isPlatformAdminEmail } from "@/lib/server/platform";
 import { getEnv } from "@/lib/server/env";
+import { tenantAccessError } from "@/lib/server/subscription";
 
 export const runtime = "nodejs";
 
@@ -70,6 +71,11 @@ export async function POST(req: NextRequest) {
   user.lockedUntil = null;
   await user.save();
 
+  const tenantError = await tenantAccessError(user.businessId);
+  if (tenantError) {
+    return NextResponse.json({ error: tenantError }, { status: 403 });
+  }
+
   if (user.role === "DELIVERY") {
     const binding = await enforceDeviceBinding(user._id.toString(), deviceId);
     if (!binding.allowed) {

src/app/api/auth/me/route.ts

@@ -5,6 +5,7 @@ import { Branch } from "@/lib/server/models/Branch";
 import { Business } from "@/lib/server/models/Business";
 import { getAuth } from "@/lib/server/auth";
 import { isPlatformAdminEmail } from "@/lib/server/platform";
+import { isMpesaEnabled } from "@/lib/server/env";
 import { TIERS, type TierId, type SubscriptionStatus } from "@/lib/tiers";
 
 export const runtime = "nodejs";
@@ -49,5 +50,6 @@ export async function GET(req: NextRequest) {
       maxBranches: tierDef.maxBranches,
       maxUsers: tierDef.maxUsers,
     },
+    features: { mpesa: isMpesaEnabled() },
   });
 }

src/app/api/auth/refresh/route.ts

@@ -3,6 +3,7 @@ import { connectDb } from "@/lib/server/db";
 import { User } from "@/lib/server/models/User";
 import { UserSession } from "@/lib/server/models/UserSession";
 import { signAccessToken, generateRefreshToken, hashRefreshToken, refreshTtlMs } from "@/lib/server/jwt";
+import { tenantAccessError } from "@/lib/server/subscription";
 import { ACCESS_COOKIE, REFRESH_COOKIE, accessCookieOptions, refreshCookieOptions } from "@/lib/server/auth";
 
 export const runtime = "nodejs";
@@ -29,6 +30,11 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "Account no longer active" }, { status: 401 });
   }
 
+  const tenantError = await tenantAccessError(user.businessId);
+  if (tenantError) {
+    return NextResponse.json({ error: tenantError }, { status: 403 });
+  }
+
   const newRefreshToken = generateRefreshToken();
   session.refreshTokenHash = hashRefreshToken(newRefreshToken);
   session.lastUsedAt = new Date();

src/app/api/auth/signup/route.ts

@@ -11,6 +11,7 @@ import { signAccessToken, generateRefreshToken, hashRefreshToken, refreshTtlMs }
 import { ACCESS_COOKIE, REFRESH_COOKIE, accessCookieOptions, refreshCookieOptions } from "@/lib/server/auth";
 import { normalizeKenyanPhone } from "@/lib/server/phone";
 import { DEFAULT_TIER, TRIAL_DAYS } from "@/lib/tiers";
+import { isPlatformAdminEmail } from "@/lib/server/platform";
 
 export const runtime = "nodejs";
 
@@ -52,6 +53,14 @@ export async function POST(req: NextRequest) {
 
   const lowerEmail = email.toLowerCase();
 
+  // Platform-operator rights are granted by email (PLATFORM_ADMIN_EMAILS)
+  // and signup does not verify email ownership, so an operator address
+  // must never be claimable through public signup. Operator accounts are
+  // created with `npm run seed` instead.
+  if (isPlatformAdminEmail(lowerEmail)) {
+    return NextResponse.json({ error: "This email cannot be used to sign up." }, { status: 403 });
+  }
+
   const emailTaken = await User.findOne({ email: lowerEmail }).lean();
   if (emailTaken) {
     return NextResponse.json({ error: "An account with this email already exists." }, { status: 409 });