feat: reminders, Excel customer import and security hardening

Features
- Payment reminders via Resend (candidates, send, history, test email)
- Bulk import of the customer list from Excel/CSV in the dashboard
- Dashboard i18n (en/nl) with language selector

Security
- Enforce venue isolation on all /venues/:venueId routes
- Require admin for planned-tab changes and pairing codes
- Rate-limit login and device registration; opt-in TRUST_PROXY
- Require JWT_SECRET in production; stop leaking internal errors
- Escape customer names in reminder emails

Sync and commands
- Remove tabs the terminal no longer reports; validate nested sync payload
- Return all pending commands on every sync (fixes missed-command race)
- First command ack wins; atomic registration code claim
- Reject commands for revoked devices, stale versions or duplicates
- Remind only unpaid balances, with a 7-day cooldown

Dashboard
- Share a single token refresh across concurrent 401s (random logouts)
- Keep the session alive for the refresh token lifetime

Deployment
- Replace `db push --accept-data-loss` with migrations (baselines legacy DBs)
- Set NODE_ENV=production; pass Resend and TRUST_PROXY env in prod compose

apps/api/src/devices/devices.controller.ts

@@ -9,7 +9,8 @@ import {
   HttpStatus,
   Req,
 } from '@nestjs/common';
-import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
+import { Throttle } from '@nestjs/throttler';
+import { ApiTags, ApiOperation, ApiBearerAuth, ApiResponse } from '@nestjs/swagger';
 import { DevicesService } from './devices.service';
 import { AuthService } from '../auth/auth.service';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
@@ -29,7 +30,9 @@ export class DevicesController {
   ) {}
 
   @Post('register')
+  @Throttle({ default: { limit: 10, ttl: 60000 } })
   @ApiOperation({ summary: 'Register a new device' })
+  @ApiResponse({ status: 201, description: 'Device registered successfully' })
   async register(@Body() dto: RegisterDeviceDto) {
     return this.authService.registerDevice(dto.venueId, dto.name, dto.registrationCode);
   }
@@ -37,13 +40,15 @@ export class DevicesController {
   @Post(':deviceId/sync')
   @UseGuards(DeviceAuthGuard)
   @ApiOperation({ summary: 'Sync device state with server' })
+  @ApiResponse({ status: 200, description: 'Sync successful, returns pending commands' })
   async sync(@Param('deviceId') deviceId: string, @Body() dto: SyncDto, @Req() req: any) {
     return this.devicesService.sync(req.user, dto);
   }
 
   @Post(':deviceId/commands/:commandId/ack')
   @UseGuards(DeviceAuthGuard)
-  @ApiOperation({ summary: 'Acknowledge a command' })
+  @ApiOperation({ summary: 'Acknowledge a command result' })
+  @ApiResponse({ status: 200, description: 'Command acknowledged' })
   async ackCommand(
     @Param('deviceId') deviceId: string,
     @Param('commandId') commandId: string,
@@ -54,9 +59,11 @@ export class DevicesController {
   }
 
   @Get('generation-code')
-  @UseGuards(JwtAuthGuard)
-  @ApiOperation({ summary: 'Generate a registration code' })
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles('admin')
   @ApiBearerAuth()
+  @ApiOperation({ summary: 'Generate a registration code for pairing' })
+  @ApiResponse({ status: 200, description: 'Registration code generated' })
   async generateCode(@Req() req: any) {
     const venueId = req.user.venueId;
     return this.authService.generateRegistrationCode(venueId);