feat: add plannedTabs

apps/api/src/auth/auth.service.ts

@@ -132,6 +132,15 @@ export class AuthService {
     const { rawToken, hash, prefix, expiresAt } = await this.generateDeviceToken();
     const deviceId = uuidv4();
 
+    // One device per venue — revoke any existing device
+    const existing = await this.prisma.device.findFirst({ where: { venueId, revokedAt: null } });
+    if (existing) {
+      await this.prisma.device.update({
+        where: { id: existing.id },
+        data: { revokedAt: new Date() },
+      });
+    }
+
     await this.prisma.device.create({
       data: {
         id: deviceId,
@@ -153,6 +162,33 @@ export class AuthService {
     return { deviceId, token: rawToken, tokenExpiresAt: expiresAt };
   }
 
+  async createUser(venueId: string, email: string, password: string, name: string, role: string) {
+    const venue = await this.prisma.venue.findUnique({ where: { id: venueId } });
+    if (!venue) {
+      throw new NotFoundException({ code: 'venue_not_found', message: 'Venue not found. Your session may be stale — try logging out and back in.' });
+    }
+
+    const existingUser = await this.prisma.clientUser.findUnique({ where: { email } });
+    if (existingUser) {
+      throw new ConflictException({ code: 'email_exists', message: 'A user with this email already exists' });
+    }
+
+    const passwordHash = await bcrypt.hash(password, 10);
+    const user = await this.prisma.clientUser.create({
+      data: {
+        id: uuidv4(),
+        venueId,
+        email,
+        passwordHash,
+        name,
+        role,
+      },
+      select: { id: true, email: true, name: true, role: true, venueId: true, createdAt: true },
+    });
+
+    return user;
+  }
+
   async validateDevice(deviceId: string, token: string): Promise<any> {
     const hash = crypto.createHash('sha256').update(token).digest('hex');
     const device = await this.prisma.device.findUnique({ where: { id: deviceId } });