Security fixes:
- Register route validates company exists before creating user
- Rate limiting on auth routes (10 per 15min per IP)
- Dev auth plugin guards against production use
- Main.ts throws if JWT_SECRET missing in production
Added Phase 2 audit doc (22) covering:
- Built vs planning doc comparison
- Security review with fixes applied
- Duplicate code patterns identified
- Standard POS feature gap analysis
- Music-specific feature gaps
33 tests passing.
Commission is default for most products. Simple model: employee
rate × sale price. Override table for exceptions (consignment at 0%,
category-level adjustments). Commission snapshotted at time of sale.
Covers consignment lifecycle, settlement workflow, POS integration,
accounting journal entries (commission income vs consignment payable),
reporting, and business rules. Consignment items use account entity
for consignors (not suppliers).
Replace stripe_customer_id on account with account_processor_link
table. Update account_payment_method to use processor enum +
processor_payment_method_id instead of Stripe-specific fields.
Supports multiple simultaneous processors for migration scenarios.
