Post Phase 8 - Fixes 1

Delivered:

Super Administrator — env-var provisioned, no StaffProfile at all (structural exclusion from Team/barber-picker/appointments/staff-totals, not a filter). hasPermission short-circuit + new getActingBusinessContext() helper retrofitted across 16 owner pages so it can actually manage the business.
Media Manager — one upload/library/external-URL modal + field picker, backing every image field app-wide. Local-disk storage + Docker volume, SVG rejected, size-capped.
Welcome backgrounds — desktop/mobile images with CSS breakpoint swap.
Business Branding settings — logo/cover/welcome/favicon/icon/colours all editable post-install; cover image finally rendered (was dead config).
Service descriptions — now surfaced on Home and in the booking flow.
Loyalty card — live preview, ColorPicker/MediaPicker/IconPicker, flip removed for a static premium-styled card, Loyalty added to bottom nav. Fixed a real pre-existing bug where the card's configured colour/image/icon were stored but never actually rendered.
Home Screen Redesign — hero gallery + sticky Services/Portfolio/Reviews/Details tabs, backed by a new unified gallery model/service (no hero/portfolio duplication). Details tab surfaces social links and a map that were never shown before.
Google Reviews — real sync pipeline (24h cron, CRON_SECRET-gated, mirrors the existing notification cron exactly), DB-only customer reads, owner hide/unhide + policy management page.
Architecture cleanup — SettingsPageShell extracted from 6 duplicated page wrappers; fixed a second pre-existing bug where branding image fields could never actually be cleared once set.
Verification: 418 tests passing (236 unit + 182 integration, all against a real MySQL database), full typecheck/lint clean across src, and a real Docker build+run cycle — which caught and fixed a genuine bug (scripts/ wasn't copied into the production image, so Super Admin sync would have crashed on every real deployment).

scripts/ensure-super-admin.ts

@@ -0,0 +1,83 @@
+/**
+ * Idempotent Super Administrator provisioning, run on every container
+ * start (see docker/entrypoint.sh) — NOT part of the installation wizard,
+ * per the brief's explicit requirement that this account come from
+ * environment variables. Safe to run repeatedly: re-hashes and syncs the
+ * password/name from the env vars every run, so rotating
+ * SUPER_ADMIN_PASSWORD and restarting the container is how you change it.
+ *
+ * Deliberately does NOT create a StaffProfile — that's what keeps the
+ * Super Administrator out of the Team list, the customer-facing barber
+ * picker, and off the Appointment.staffId foreign key entirely, by
+ * construction rather than a filter. See src/lib/auth/permissions.ts
+ * (hasPermission's isSuperAdmin short-circuit) and
+ * src/lib/business/get-acting-business-context.ts.
+ *
+ * Uses relative imports (not the "@/..." alias) and constructs its own
+ * PrismaClient, matching prisma/seed.ts — both scripts run under `tsx`
+ * outside Next's own module resolution/bundling.
+ */
+import "dotenv/config";
+import bcrypt from "bcryptjs";
+import { PrismaClient } from "../generated/prisma/client";
+import { PrismaMariaDb } from "@prisma/adapter-mariadb";
+import { buildMysqlPoolConfig } from "../src/lib/db/mysql-pool-config";
+
+const BCRYPT_COST = 12; // matches src/features/installation/installer.service.ts
+
+async function main() {
+  const email = process.env.SUPER_ADMIN_EMAIL?.trim().toLowerCase();
+  if (!email) {
+    console.log("[ensure-super-admin] SUPER_ADMIN_EMAIL not set — skipping (no Super Administrator configured).");
+    return;
+  }
+
+  const password = process.env.SUPER_ADMIN_PASSWORD;
+  if (!password || password.length < 8) {
+    console.error(
+      "[ensure-super-admin] SUPER_ADMIN_EMAIL is set but SUPER_ADMIN_PASSWORD is missing or shorter than 8 characters. Refusing to provision a Super Administrator with no usable password.",
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  const firstName = process.env.SUPER_ADMIN_FIRST_NAME?.trim() ?? "";
+  const lastName = process.env.SUPER_ADMIN_LAST_NAME?.trim() ?? "";
+  const name = [firstName, lastName].filter(Boolean).join(" ") || null;
+
+  const adapter = new PrismaMariaDb(buildMysqlPoolConfig(process.env.DATABASE_URL));
+  const prisma = new PrismaClient({ adapter });
+
+  try {
+    const passwordHash = await bcrypt.hash(password, BCRYPT_COST);
+    const existing = await prisma.user.findUnique({ where: { email } });
+
+    if (existing && !existing.isSuperAdmin) {
+      console.error(
+        `[ensure-super-admin] A user with email ${email} already exists and is not a Super Administrator. Refusing to overwrite it — use a different SUPER_ADMIN_EMAIL or remove the conflicting account first.`,
+      );
+      process.exitCode = 1;
+      return;
+    }
+
+    if (existing) {
+      await prisma.user.update({
+        where: { id: existing.id },
+        data: { name, passwordHash, emailVerified: existing.emailVerified ?? new Date() },
+      });
+      console.log(`[ensure-super-admin] Synced credentials for existing Super Administrator (${email}).`);
+    } else {
+      await prisma.user.create({
+        data: { email, name, passwordHash, isSuperAdmin: true, emailVerified: new Date() },
+      });
+      console.log(`[ensure-super-admin] Created Super Administrator (${email}).`);
+    }
+  } finally {
+    await prisma.$disconnect();
+  }
+}
+
+main().catch((error) => {
+  console.error("[ensure-super-admin] Failed:", error);
+  process.exitCode = 1;
+});