Stores, Team and Account run against the platform, not a mock

Stores: each shop's health in one line (offline, losing visits, camera
trouble, faces too poor - in severity order, one verdict), its cameras
as pictures with connection and 'proven to recognise a face' as two
different claims, add/edit/remove camera with the make picker, test
connection and placement checks claimed by the shop PC, and the
enrolment code a new shop PC types. Team: create an account (password
shown once), invite (code shown once), change role, remove access, reset
password, revoke pending invitations - with the rank rules the server
enforces mirrored in what the form offers. Account: who you are and
every device signed in, with 'sign out' per device and everywhere else.

Gone: StoreManagement, SecurityManager and ProfileForm that rendered
hard-coded arrays, the Business form with no backend, the /api/stores
route nothing served, and the cascading account menu's dead links.

Two things found by using the camera form, not by tests: Chrome filled
the operator's own email into 'camera username', and the first camera
saved with a password and no username because autofill wrote to the
input without React seeing it. The dialog sets autocomplete on the real
inputs and reads the credential fields from the DOM at submit.

Every route was exercised against production before this commit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KGcjxF1cNLcuwc3DAPcnfj

src/app/api/sites/[site]/enrolment-code/route.ts

@@ -0,0 +1,19 @@
+import type {NextRequest} from 'next/server';
+import {sitesApi} from '@/services/api/sitesApi';
+import {proxyUpstream} from '@/shared/services/bff';
+
+export const dynamic = 'force-dynamic';
+
+/** POST /api/sites/{site}/enrolment-code - the code a new shop PC types. */
+export async function POST(req: NextRequest, ctx: {params: Promise<{site: string}>}) {
+  const {site} = await ctx.params;
+  return proxyUpstream(
+    req,
+    (token, body) =>
+      sitesApi.enrolmentCode(token, site, {
+        label: typeof body.label === 'string' ? body.label : undefined,
+        ttl_hours: typeof body.ttl_hours === 'number' ? body.ttl_hours : undefined,
+      }),
+    {status: 201},
+  );
+}