Multi-tenant foundations
- Supabase Auth for merchant staff with email/password and session handling
- Owner/Admin/Staff base roles with permission presets and groups for delegated writes
- Tenant memberships and org switching for staff who work across brands
- API guards enforce tenant scoping on every public, merchant, and platform route