feat: reminders, Excel customer import and security hardening

Features
- Payment reminders via Resend (candidates, send, history, test email)
- Bulk import of the customer list from Excel/CSV in the dashboard
- Dashboard i18n (en/nl) with language selector

Security
- Enforce venue isolation on all /venues/:venueId routes
- Require admin for planned-tab changes and pairing codes
- Rate-limit login and device registration; opt-in TRUST_PROXY
- Require JWT_SECRET in production; stop leaking internal errors
- Escape customer names in reminder emails

Sync and commands
- Remove tabs the terminal no longer reports; validate nested sync payload
- Return all pending commands on every sync (fixes missed-command race)
- First command ack wins; atomic registration code claim
- Reject commands for revoked devices, stale versions or duplicates
- Remind only unpaid balances, with a 7-day cooldown

Dashboard
- Share a single token refresh across concurrent 401s (random logouts)
- Keep the session alive for the refresh token lifetime

Deployment
- Replace `db push --accept-data-loss` with migrations (baselines legacy DBs)
- Set NODE_ENV=production; pass Resend and TRUST_PROXY env in prod compose

apps/api/src/reminders/reminders.controller.ts

@@ -0,0 +1,51 @@
+import { Controller, Get, Post, Param, UseGuards, Req } from '@nestjs/common';
+import { ApiTags, ApiOperation, ApiBearerAuth, ApiResponse } from '@nestjs/swagger';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
+import { RolesGuard } from '../common/guards/roles.guard';
+import { Roles } from '../common/decorators/roles.decorator';
+import { VenueAccessGuard } from '../common/guards/venue-access.guard';
+import { RemindersService } from './reminders.service';
+
+@ApiTags('Reminders')
+@ApiBearerAuth()
+@UseGuards(JwtAuthGuard, VenueAccessGuard)
+@Controller('venues/:venueId/reminders')
+export class RemindersController {
+  constructor(private service: RemindersService) {}
+
+  @Get('candidates')
+  @ApiOperation({ summary: 'List tabs eligible for payment reminders' })
+  @ApiResponse({ status: 200, description: 'List of eligible tabs with customer email and amount' })
+  async listCandidates(@Param('venueId') venueId: string) {
+    return this.service.listCandidates(venueId);
+  }
+
+  @Post('send')
+  @ApiOperation({ summary: 'Send payment reminders via Resend' })
+  @ApiResponse({ status: 201, description: 'Reminders sent' })
+  @ApiResponse({ status: 400, description: 'Resend not configured' })
+  async send(@Param('venueId') venueId: string, @Req() req: any) {
+    return this.service.sendReminders(venueId, req.user?.email || 'unknown');
+  }
+
+  @Get()
+  @ApiOperation({ summary: 'Get reminder history' })
+  @ApiResponse({ status: 200, description: 'List of previously sent reminders' })
+  async history(@Param('venueId') venueId: string) {
+    return this.service.history(venueId);
+  }
+
+  @Post('test/:plannedTabId')
+  @UseGuards(RolesGuard)
+  @Roles('admin')
+  @ApiOperation({ summary: 'Send a test email to a planned customer (admin only)' })
+  @ApiResponse({ status: 201, description: 'Test email sent' })
+  @ApiResponse({ status: 400, description: 'Resend not configured or customer has no email' })
+  @ApiResponse({ status: 404, description: 'Planned customer not found' })
+  async sendTest(
+    @Param('venueId') venueId: string,
+    @Param('plannedTabId') plannedTabId: string,
+  ) {
+    return this.service.sendTestEmail(venueId, plannedTabId);
+  }
+}