WP-02: locations, teams and the legal configuration register

Adds the referential models, the first database-backed settings
screens, and the register the compliance matrix requires before any
parameter is enforceable.

The register is the point of the lot. The matrix is explicit that
copying another product's configuration is not enough — each parameter
must carry its value, source, effective date, population and an
approver. Approval records the session's actor, never a form field: a
signature you can type yourself is worth nothing. The screen names the
domains that have no approved parameter yet, so the gap is visible
rather than assumed closed.

Two bugs of the same family, both now structurally impossible:

- The Prisma scoping extension read a hand-written list of models
  carrying accountId. The four models added here were missing from it,
  so writes failed with an opaque Prisma error — and a read would have
  silently returned every account's rows. The list is now derived from
  the schema itself.
- The RLS policies were likewise per-table. A new integration test
  fails if any table with an accountId column lacks forced RLS and both
  policies, which is the failure mode that hides best: nobody writes a
  wrong rule, someone forgets to write one.

An end-to-end test signs in as a manager and confirms the settings
screens refuse to render — the sidebar hiding them is a convenience,
the server check is the control.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv

tests/integration/rls.test.ts

@@ -173,3 +173,56 @@ describeIfDb('immutabilité du journal d’audit', () => {
     ).rejects.toThrow(/append-only/i);
   });
 });
+
+describeIfDb('couverture des politiques', () => {
+  let client: Client;
+
+  beforeAll(async () => {
+    client = new Client({ connectionString: adminUrl });
+    await client.connect();
+  }, 30_000);
+
+  afterAll(async () => {
+    await client?.end().catch(() => undefined);
+  }, 30_000);
+
+  it('toute table portant accountId est protégée', async () => {
+    // Le mode de défaillance de la RLS n'est pas d'écrire une mauvaise règle,
+    // c'est d'oublier d'en écrire une : la table répond alors à tout le monde,
+    // en silence. Ce test échoue quand une table est ajoutée sans politique.
+    const { rows } = await client.query<{
+      table_name: string;
+      relrowsecurity: boolean;
+      relforcerowsecurity: boolean;
+      policies: number;
+    }>(`
+      SELECT c.relname AS table_name,
+             c.relrowsecurity,
+             c.relforcerowsecurity,
+             (SELECT count(*)::int FROM pg_policy p WHERE p.polrelid = c.oid) AS policies
+      FROM pg_class c
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE n.nspname = 'public'
+        AND c.relkind = 'r'
+        AND EXISTS (
+          SELECT 1 FROM information_schema.columns col
+          WHERE col.table_schema = 'public'
+            AND col.table_name = c.relname
+            AND col.column_name = 'accountId'
+        )
+      ORDER BY c.relname
+    `);
+
+    expect(rows.length).toBeGreaterThan(0);
+
+    const unprotected = rows.filter(
+      (row) =>
+        !row.relrowsecurity || !row.relforcerowsecurity || row.policies < 2,
+    );
+
+    expect(
+      unprotected.map((row) => row.table_name),
+      'tables sans RLS forcée ou sans politique de lecture et d’écriture',
+    ).toEqual([]);
+  });
+});