Fixed the remaining Manager runtime coupling.

1. Root cause of the database error
The Manager proxy was bypassing installation checks, but / still resolved to src/app/page.tsx, which statically imported:
- @/auth
- Prisma
- business branding
- business permissions
- primary business data
The root route now redirects to /manager inside the proxy before the business homepage is evaluated.
2. Root cause of the Auth.js error
The global business SessionProvider was mounted around Manager pages. It automatically requested:

The business homepage is not evaluated first.
5. Provider and authentication separation
Manager mode:
- Uses ManagerProviders
- Uses the signed Manager cookie session
- Does not mount SessionProvider
- Does not call /api/auth/session
- Does not import business Auth.js or Prisma
Business mode:
- Dynamically loads the existing business Providers
- Continues using Auth.js and SessionProvider
- Preserves installation, /owner, and /staff behavior
6. Database independence
Manager mode now avoids database initialization for:
- Proxy requests
- Root metadata and viewport
- Root routing
- Manager pages
- Manager APIs
- Manifest requests
- Health requests
- Business Auth.js requests
- Business cron requests
No fake DATABASE_* variables were added.
7. Tests
Added coverage for:
- Manager / routing
- Manager /manager access
- No installation-state check in Manager mode
- Prisma import protection
- Business installation checks
- /owner protection
- Business Auth.js 404 boundary
- Manager health route without Prisma
- Manager manifest without business branding
8. Validation

src/proxy.ts

@@ -91,6 +91,11 @@ export async function handleProxyRequest(req: AuthenticatedNextRequest) {
   // Manager is a separate deployment and hostname, so its root pathname is
   // normally `/`, not `/manager`. Branch before loading any business module.
   if (process.env.MANAGER_MODE === "true") {
+    if (pathname === "/") {
+      const response = NextResponse.redirect(new URL("/manager", req.nextUrl.origin));
+      response.headers.set("Content-Security-Policy", csp);
+      return response;
+    }
     const response = NextResponse.next();
     response.headers.set("Content-Security-Policy", csp);
     return response;