Authenticate the console's /web surface

The /web endpoints have never had authentication. The console keeps its
login record in per-tab sessionStorage and sends no Authorization header,
so every endpoint under /v1/web read `tenantid` off the query string and
believed it — one number in a URL reached another merchant's orders,
stock, staff and takings. `createposuser` under /v1/web/tenants minted
till credentials on the strength of an unauthenticated request, which the
route file already flagged in as many words.

Closed the same way posauth.go closed it for the terminals, in the same
order: the caller holds a token this server signed, and the tenant they
name is the tenant inside that token.

- utils/webtoken.go   same HMAC construction as the POS token, 12h TTL,
                      a `w1.` prefix so the two kinds cannot verify as
                      each other
- middleware/webauth.go  verifies the token, pins the tenant, and checks
                      a named branch belongs to it; reads the tenant from
                      the query, the body, and inside a JSON array, since
                      createdeliveries posts one
- login now issues the token; the console sends it as Bearer

Platform access rides on issuperadmin and nothing else. Not the role —
app_roles calls roleid 1 "Super admin" and tenant onboarding wrote 1 for
every shop owner, so a role test would promote every merchant on the
platform. Not a zero tenant either, or a user row with the field unset
becomes the one session that reads everything. Both near-misses have
tests.

WEB_AUTH_REQUIRED defaults to off. The console in production does not
send a token yet, and enforcing before it does would lock every merchant
out of a working product. A token that IS sent is always verified, and
one naming the wrong tenant is always refused; the flag only decides what
happens to a request carrying none. This should be a short-lived state.

Still trusting the caller: partnerid, customerid and appuserid, which
some list endpoints also scope on. Noted in the middleware header.

25 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

controllers/userController.go

@@ -1,16 +1,63 @@
 package controllers
 
 import (
+	"log"
 	"net/http"
 	"strconv"
 	"strings"
+	"time"
 
 	"nearle/models"
 	"nearle/services"
+	"nearle/utils"
 
 	"github.com/gofiber/fiber/v2"
 )
 
+// attachWebSession hands a signed-in console user their session token.
+//
+// Added to the login response rather than served from a second endpoint, so the
+// console receives it on the call it already makes and nothing changes about
+// when or how it signs in.
+//
+// The claims come from the user's own record, which is the whole point: until
+// now the console asserted its tenant on every request and was believed, and
+// sealing it under a signature here is what makes `middleware.WebAuth` able to
+// refuse a request naming somebody else's.
+//
+// `Issuperadmin` is copied across as the ONLY source of cross-tenant access.
+// Not the role — `app_roles` calls roleid 1 "Super admin" and tenant onboarding
+// wrote 1 for every shop owner, so trusting the role would promote every
+// merchant on the platform.
+//
+// A failure to mint is logged and swallowed, deliberately, while
+// WEB_AUTH_REQUIRED is off: a deployment that has not set a signing key yet must
+// still be able to sign in, or shipping this takes the console down everywhere
+// the secret is missing. Once enforcement is on, no token means no session —
+// which is then the correct and loud failure.
+//
+// The parameter is the underlying map type rather than `fiber.Map`, because the
+// two login paths do not agree on which fiber that is: `AppLogin` returns the
+// v1 package's `Map` and `TenantWebLogin` the v2 one. Both are
+// `map[string]any`, so taking that accepts either without dragging the
+// old import into this file.
+func attachWebSession(resp map[string]any, info models.TenantUserInfo) {
+	token, expires, err := utils.MintWebToken(utils.WebClaims{
+		Userid:     info.Userid,
+		Tenantid:   info.Tenantid,
+		Locationid: info.Locationid,
+		Roleid:     info.Roleid,
+		Configid:   info.Configid,
+		Superadmin: info.Issuperadmin,
+	}, time.Now())
+	if err != nil {
+		log.Printf("login: could not issue a console session for user %d: %v", info.Userid, err)
+		return
+	}
+	resp["token"] = token
+	resp["tokenexpiresat"] = expires.Unix()
+}
+
 type UserController struct {
 	userService services.UserService
 }
@@ -179,7 +226,7 @@ func (ctl *UserController) AppLogin(c *fiber.Ctx) error {
 		})
 	}
 
-	_, resp, err := ctl.userService.AppLogin(user)
+	info, resp, err := ctl.userService.AppLogin(user)
 	if err != nil {
 		// Use resp.Code if present, fallback to 409
 		code := http.StatusConflict
@@ -189,6 +236,8 @@ func (ctl *UserController) AppLogin(c *fiber.Ctx) error {
 		return c.Status(code).JSON(resp)
 	}
 
+	attachWebSession(resp, info)
+
 	// ✅ Always return resp
 	return c.Status(http.StatusOK).JSON(resp)
 }
@@ -244,6 +293,7 @@ func (ctl *UserController) TenantWebLogin(c *fiber.Ctx) error {
 	// Include tenant user info if login successful (code 200)
 	if code == fiber.StatusOK {
 		resp["details"] = info
+		attachWebSession(resp, info)
 	}
 
 	return c.Status(code).JSON(resp)