feat: reminders, Excel customer import and security hardening

Features
- Payment reminders via Resend (candidates, send, history, test email)
- Bulk import of the customer list from Excel/CSV in the dashboard
- Dashboard i18n (en/nl) with language selector

Security
- Enforce venue isolation on all /venues/:venueId routes
- Require admin for planned-tab changes and pairing codes
- Rate-limit login and device registration; opt-in TRUST_PROXY
- Require JWT_SECRET in production; stop leaking internal errors
- Escape customer names in reminder emails

Sync and commands
- Remove tabs the terminal no longer reports; validate nested sync payload
- Return all pending commands on every sync (fixes missed-command race)
- First command ack wins; atomic registration code claim
- Reject commands for revoked devices, stale versions or duplicates
- Remind only unpaid balances, with a 7-day cooldown

Dashboard
- Share a single token refresh across concurrent 401s (random logouts)
- Keep the session alive for the refresh token lifetime

Deployment
- Replace `db push --accept-data-loss` with migrations (baselines legacy DBs)
- Set NODE_ENV=production; pass Resend and TRUST_PROXY env in prod compose

apps/dashboard/src/lib/api/client.ts

@@ -15,7 +15,9 @@ function getTokens() {
 }
 
 function setTokens(accessToken: string, refreshToken: string) {
-  document.cookie = `access_token=${accessToken}; path=/; max-age=${24 * 60 * 60}; SameSite=Lax`;
+  // The access cookie outlives the JWT on purpose: pages decode it for venue/role, and an
+  // expired JWT triggers a 401 which is transparently refreshed below.
+  document.cookie = `access_token=${accessToken}; path=/; max-age=${30 * 24 * 60 * 60}; SameSite=Lax`;
   document.cookie = `refresh_token=${refreshToken}; path=/; max-age=${30 * 24 * 60 * 60}; SameSite=Lax`;
 }
 
@@ -24,7 +26,19 @@ function clearTokens() {
   document.cookie = 'refresh_token=; path=/; max-age=0';
 }
 
-async function refreshAccessToken(): Promise<string | null> {
+// Refresh tokens rotate on use, so concurrent 401s must share a single refresh request
+let refreshInFlight: Promise<string | null> | null = null;
+
+function refreshAccessToken(): Promise<string | null> {
+  if (!refreshInFlight) {
+    refreshInFlight = doRefreshAccessToken().finally(() => {
+      refreshInFlight = null;
+    });
+  }
+  return refreshInFlight;
+}
+
+async function doRefreshAccessToken(): Promise<string | null> {
   const refreshToken = document.cookie
     .split('; ')
     .find((row) => row.startsWith('refresh_token='))
@@ -169,12 +183,29 @@ export const venuesApi = {
 // Planned Tabs API
 export const plannedTabsApi = {
   list: (venueId: string) => api<{ plannedTabs: any[] }>(`/venues/${venueId}/planned-tabs`),
-  create: (venueId: string, customerName: string) =>
-    api(`/venues/${venueId}/planned-tabs`, { method: 'POST', body: JSON.stringify({ customerName }) }),
-  update: (venueId: string, id: string, customerName: string) =>
-    api(`/venues/${venueId}/planned-tabs/${id}`, { method: 'PUT', body: JSON.stringify({ customerName }) }),
+  create: (venueId: string, customerName: string, email?: string) =>
+    api(`/venues/${venueId}/planned-tabs`, { method: 'POST', body: JSON.stringify({ customerName, email }) }),
+  update: (venueId: string, id: string, customerName: string, email?: string) =>
+    api(`/venues/${venueId}/planned-tabs/${id}`, { method: 'PUT', body: JSON.stringify({ customerName, email }) }),
   remove: (venueId: string, id: string) =>
     api(`/venues/${venueId}/planned-tabs/${id}`, { method: 'DELETE' }),
+  import: (venueId: string, entries: { customerName: string; email?: string }[], mode: 'merge' | 'replace') =>
+    api<{ created: number; updated: number; unchanged: number; removed: number }>(`/venues/${venueId}/planned-tabs/import`, {
+      method: 'POST',
+      body: JSON.stringify({ entries, mode }),
+    }),
+};
+
+// Reminders API
+export const remindersApi = {
+  candidates: (venueId: string) =>
+    api<{ candidates: any[] }>(`/venues/${venueId}/reminders/candidates`),
+  send: (venueId: string) =>
+    api<{ sent: number; total: number; errors?: { customerName: string; error: string }[] }>(`/venues/${venueId}/reminders/send`, { method: 'POST' }),
+  history: (venueId: string) =>
+    api<{ reminders: any[] }>(`/venues/${venueId}/reminders`),
+  sendTest: (venueId: string, plannedTabId: string) =>
+    api<{ ok: boolean; email: string; customerName: string }>(`/venues/${venueId}/reminders/test/${plannedTabId}`, { method: 'POST' }),
 };
 
 export { setTokens, clearTokens };