Fixed the remaining Manager runtime coupling.

1. Root cause of the database error
The Manager proxy was bypassing installation checks, but / still resolved to src/app/page.tsx, which statically imported:
- @/auth
- Prisma
- business branding
- business permissions
- primary business data
The root route now redirects to /manager inside the proxy before the business homepage is evaluated.
2. Root cause of the Auth.js error
The global business SessionProvider was mounted around Manager pages. It automatically requested:

The business homepage is not evaluated first.
5. Provider and authentication separation
Manager mode:
- Uses ManagerProviders
- Uses the signed Manager cookie session
- Does not mount SessionProvider
- Does not call /api/auth/session
- Does not import business Auth.js or Prisma
Business mode:
- Dynamically loads the existing business Providers
- Continues using Auth.js and SessionProvider
- Preserves installation, /owner, and /staff behavior
6. Database independence
Manager mode now avoids database initialization for:
- Proxy requests
- Root metadata and viewport
- Root routing
- Manager pages
- Manager APIs
- Manifest requests
- Health requests
- Business Auth.js requests
- Business cron requests
No fake DATABASE_* variables were added.
7. Tests
Added coverage for:
- Manager / routing
- Manager /manager access
- No installation-state check in Manager mode
- Prisma import protection
- Business installation checks
- /owner protection
- Business Auth.js 404 boundary
- Manager health route without Prisma
- Manager manifest without business branding
8. Validation

src/__tests__/manager-auth-route.test.ts

@@ -0,0 +1,26 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+// The Manager must not load the business Auth.js module even if a stale
+// client requests `/api/auth/session`.
+vi.mock("@/auth", () => {
+  throw new Error("Business Auth.js must not load in Manager mode.");
+});
+
+import { GET } from "@/app/api/auth/[...nextauth]/route";
+
+describe("Manager business-auth boundary", () => {
+  const originalManagerMode = process.env.MANAGER_MODE;
+
+  afterEach(() => {
+    if (originalManagerMode === undefined) delete process.env.MANAGER_MODE;
+    else process.env.MANAGER_MODE = originalManagerMode;
+  });
+
+  it("returns 404 without importing business Auth.js", async () => {
+    process.env.MANAGER_MODE = "true";
+
+    const response = await GET(new Request("https://manager.example.com/api/auth/session"));
+
+    expect(response.status).toBe(404);
+  });
+});