Post Phase 8 - Fixes 1

Delivered:

Super Administrator — env-var provisioned, no StaffProfile at all (structural exclusion from Team/barber-picker/appointments/staff-totals, not a filter). hasPermission short-circuit + new getActingBusinessContext() helper retrofitted across 16 owner pages so it can actually manage the business.
Media Manager — one upload/library/external-URL modal + field picker, backing every image field app-wide. Local-disk storage + Docker volume, SVG rejected, size-capped.
Welcome backgrounds — desktop/mobile images with CSS breakpoint swap.
Business Branding settings — logo/cover/welcome/favicon/icon/colours all editable post-install; cover image finally rendered (was dead config).
Service descriptions — now surfaced on Home and in the booking flow.
Loyalty card — live preview, ColorPicker/MediaPicker/IconPicker, flip removed for a static premium-styled card, Loyalty added to bottom nav. Fixed a real pre-existing bug where the card's configured colour/image/icon were stored but never actually rendered.
Home Screen Redesign — hero gallery + sticky Services/Portfolio/Reviews/Details tabs, backed by a new unified gallery model/service (no hero/portfolio duplication). Details tab surfaces social links and a map that were never shown before.
Google Reviews — real sync pipeline (24h cron, CRON_SECRET-gated, mirrors the existing notification cron exactly), DB-only customer reads, owner hide/unhide + policy management page.
Architecture cleanup — SettingsPageShell extracted from 6 duplicated page wrappers; fixed a second pre-existing bug where branding image fields could never actually be cleared once set.
Verification: 418 tests passing (236 unit + 182 integration, all against a real MySQL database), full typecheck/lint clean across src, and a real Docker build+run cycle — which caught and fixed a genuine bug (scripts/ wasn't copied into the production image, so Super Admin sync would have crashed on every real deployment).

src/lib/auth/permissions.ts

@@ -26,7 +26,27 @@ export const getStaffPermissions = cache(async (userId: string): Promise<Set<Per
   return new Set(staffProfile.role.permissions.map((rolePermission) => rolePermission.permission));
 });
 
+/**
+ * Phase 9 — the platform-level Super Administrator (see
+ * scripts/ensure-super-admin.ts). Deliberately re-checks the database
+ * rather than trusting the JWT, same rationale as getStaffPermissions.
+ */
+export const isSuperAdmin = cache(async (userId: string): Promise<boolean> => {
+  const user = await prisma.user.findUnique({ where: { id: userId }, select: { isSuperAdmin: true } });
+  return user?.isSuperAdmin ?? false;
+});
+
+/**
+ * A Super Administrator has every permission an Owner has — OWNER_PERMISSIONS
+ * (src/lib/roles/default-permissions.ts) already IS the full Permission enum,
+ * so short-circuiting true here rather than granting a StaffProfile/Role is
+ * exactly equivalent, without giving the Super Admin a StaffProfile row at
+ * all (see docs/phase-9-summary.md, "Super Administrator" — this is what
+ * keeps them out of the Team list, barber picker, and appointment FKs
+ * structurally rather than via a filter).
+ */
 export async function hasPermission(userId: string, permission: Permission): Promise<boolean> {
+  if (await isSuperAdmin(userId)) return true;
   const permissions = await getStaffPermissions(userId);
   return permissions.has(permission);
 }