Post Phase 8 - Fixes 1

Delivered:

Super Administrator — env-var provisioned, no StaffProfile at all (structural exclusion from Team/barber-picker/appointments/staff-totals, not a filter). hasPermission short-circuit + new getActingBusinessContext() helper retrofitted across 16 owner pages so it can actually manage the business.
Media Manager — one upload/library/external-URL modal + field picker, backing every image field app-wide. Local-disk storage + Docker volume, SVG rejected, size-capped.
Welcome backgrounds — desktop/mobile images with CSS breakpoint swap.
Business Branding settings — logo/cover/welcome/favicon/icon/colours all editable post-install; cover image finally rendered (was dead config).
Service descriptions — now surfaced on Home and in the booking flow.
Loyalty card — live preview, ColorPicker/MediaPicker/IconPicker, flip removed for a static premium-styled card, Loyalty added to bottom nav. Fixed a real pre-existing bug where the card's configured colour/image/icon were stored but never actually rendered.
Home Screen Redesign — hero gallery + sticky Services/Portfolio/Reviews/Details tabs, backed by a new unified gallery model/service (no hero/portfolio duplication). Details tab surfaces social links and a map that were never shown before.
Google Reviews — real sync pipeline (24h cron, CRON_SECRET-gated, mirrors the existing notification cron exactly), DB-only customer reads, owner hide/unhide + policy management page.
Architecture cleanup — SettingsPageShell extracted from 6 duplicated page wrappers; fixed a second pre-existing bug where branding image fields could never actually be cleared once set.
Verification: 418 tests passing (236 unit + 182 integration, all against a real MySQL database), full typecheck/lint clean across src, and a real Docker build+run cycle — which caught and fixed a genuine bug (scripts/ wasn't copied into the production image, so Super Admin sync would have crashed on every real deployment).

src/features/owner/__tests__/authorization.integration.test.ts

@@ -1,8 +1,9 @@
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { hasPermission } from "@/lib/auth/permissions";
+import { hasPermission, isSuperAdmin } from "@/lib/auth/permissions";
 import { assertOwnerPermission, OwnerPermissionDeniedError } from "../authorization";
 import { deactivateStaff, updateStaffAsOwner } from "@/services/staff/staff.service";
 import { deleteCategory } from "@/services/catalogue/service-catalogue.service";
+import { Permission } from "@/generated/prisma/enums";
 import {
   cleanupTestBusiness,
   createTestBusiness,
@@ -121,4 +122,46 @@ describe("Owner authorization and business isolation (integration)", () => {
       }
     });
   });
+
+  describe("Super Administrator (Phase 9)", () => {
+    /** Deliberately no StaffProfile at all — see scripts/ensure-super-admin.ts and docs/phase-9-summary.md. */
+    async function createTestSuperAdmin() {
+      const user = await prisma.user.create({
+        data: { email: `super-admin-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@test.local`, isSuperAdmin: true },
+      });
+      return user.id;
+    }
+
+    it("isSuperAdmin reflects the User.isSuperAdmin flag", async () => {
+      const { userId: ordinaryUserId } = await createTestStaff(business);
+      const superAdminUserId = await createTestSuperAdmin();
+      try {
+        expect(await isSuperAdmin(ordinaryUserId)).toBe(false);
+        expect(await isSuperAdmin(superAdminUserId)).toBe(true);
+      } finally {
+        await prisma.user.delete({ where: { id: superAdminUserId } });
+      }
+    });
+
+    it("hasPermission grants every permission to a Super Administrator with no StaffProfile at all", async () => {
+      const superAdminUserId = await createTestSuperAdmin();
+      try {
+        for (const permission of Object.values(Permission)) {
+          expect(await hasPermission(superAdminUserId, permission)).toBe(true);
+        }
+        expect(await prisma.staffProfile.findUnique({ where: { userId: superAdminUserId } })).toBeNull();
+      } finally {
+        await prisma.user.delete({ where: { id: superAdminUserId } });
+      }
+    });
+
+    it("does not grant permissions to an ordinary user who merely lacks a StaffProfile", async () => {
+      const user = await prisma.user.create({ data: { email: `plain-${Date.now()}@test.local` } });
+      try {
+        expect(await hasPermission(user.id, Permission.MANAGE_STAFF)).toBe(false);
+      } finally {
+        await prisma.user.delete({ where: { id: user.id } });
+      }
+    });
+  });
 });