Remove multi-tenant company_id scoping from entire codebase

Drop company_id column from all 22 domain tables via migration.
Remove companyId from JWT payload, auth plugins, all service method
signatures (~215 occurrences), all route handlers (~105 occurrences),
test runner, test suites, and frontend auth store/types.

The company table stays as store settings (name, timezone). Tenant
isolation in a SaaS deployment would be at the database level (one
DB per customer) not the application level.

All 107 API tests pass. Zero TSC errors across all packages.

packages/backend/src/routes/v1/lookups.ts

@@ -6,7 +6,7 @@ import { ConflictError, ValidationError } from '../../lib/errors.js'
 function createLookupRoutes(prefix: string, service: typeof UnitStatusService) {
   const routes: FastifyPluginAsync = async (app) => {
     app.get(`/${prefix}`, { preHandler: [app.authenticate, app.requirePermission('inventory.view')] }, async (request, reply) => {
-      const data = await service.list(app.db, request.companyId)
+      const data = await service.list(app.db)
       return reply.send({ data })
     })
 
@@ -16,12 +16,12 @@ function createLookupRoutes(prefix: string, service: typeof UnitStatusService) {
         throw new ValidationError('Validation failed', parsed.error.flatten())
       }
 
-      const existing = await service.getBySlug(app.db, request.companyId, parsed.data.slug)
+      const existing = await service.getBySlug(app.db, parsed.data.slug)
       if (existing) {
         throw new ConflictError(`Slug "${parsed.data.slug}" already exists`)
       }
 
-      const row = await service.create(app.db, request.companyId, parsed.data)
+      const row = await service.create(app.db, parsed.data)
       return reply.status(201).send(row)
     })
 
@@ -31,14 +31,14 @@ function createLookupRoutes(prefix: string, service: typeof UnitStatusService) {
       if (!parsed.success) {
         throw new ValidationError('Validation failed', parsed.error.flatten())
       }
-      const row = await service.update(app.db, request.companyId, id, parsed.data)
+      const row = await service.update(app.db, id, parsed.data)
       if (!row) return reply.status(404).send({ error: { message: 'Not found', statusCode: 404 } })
       return reply.send(row)
     })
 
     app.delete(`/${prefix}/:id`, { preHandler: [app.authenticate, app.requirePermission('inventory.admin')] }, async (request, reply) => {
       const { id } = request.params as { id: string }
-      const row = await service.delete(app.db, request.companyId, id)
+      const row = await service.delete(app.db, id)
       if (!row) return reply.status(404).send({ error: { message: 'Not found', statusCode: 404 } })
       return reply.send(row)
     })