Initial scaffold: tablet-checkin app

Staff-push guest check-in tablet. Fastify backend + React/Vite frontend,
three-tier auth (staff JWT, terminal API key, kiosk cookie), NewBook
integration via bookings_get/guests_update/bookings_update, pdfkit-based
regcard generation, marketing opt-in with Sendy/Mailchimp adapters.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

seed-app.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// Run from tablet-checkin/ dir: DATABASE_URL=... node seed-app.js
+import pg from 'pg'
+
+const { Pool } = pg
+const pool = new Pool({ connectionString: process.env.DATABASE_URL })
+
+await pool.query(`
+  INSERT INTO apps (slug, name, description, base_path, icon, theme_color, category, internal_host, internal_port)
+  VALUES ('tablet-checkin', 'Tablet Check-In', 'Staff-push guest check-in tablet — contact details, car reg, marketing opt-in, T&Cs and signature capture', '/tablet-checkin', 'UserCheck', '#be123c', 'Hotel', '10.10.10.132', 3080)
+  ON CONFLICT (slug) DO UPDATE SET
+    name          = EXCLUDED.name,
+    description   = EXCLUDED.description,
+    base_path     = EXCLUDED.base_path,
+    icon          = EXCLUDED.icon,
+    theme_color   = EXCLUDED.theme_color,
+    category      = EXCLUDED.category,
+    internal_host = EXCLUDED.internal_host,
+    internal_port = EXCLUDED.internal_port
+`)
+
+// Cap slugs are plain, not dotted/app-prefixed — scoped per-app via app_id
+// already (confirmed convention, see plant/seed-app.js). 'checkin' (the
+// tablet kiosk's own internal JWT cap, see backend/src/routes/devices.js) is
+// deliberately NOT seeded here — it must never be assignable to a human
+// staff role via the portal, only minted by this app's own kiosk login route.
+await pool.query(`
+  INSERT INTO app_capabilities (app_id, slug, name, description, sort_order)
+  SELECT a.id, c.slug, c.name, c.description, c.sort_order
+  FROM apps a, (VALUES
+    ('push',     'Push to Tablet', 'Push a booking to a check-in tablet (staff push trigger + manual test-push)', 1),
+    ('admin',    'Admin',          'View check-in audit history, manage devices, terminals and marketing config', 2),
+    ('settings', 'Settings',       'Configure tablet-checkin app settings',                                       3)
+  ) AS c(slug, name, description, sort_order)
+  WHERE a.slug = 'tablet-checkin'
+  ON CONFLICT (app_id, slug) DO UPDATE SET
+    name        = EXCLUDED.name,
+    description = EXCLUDED.description,
+    sort_order  = EXCLUDED.sort_order
+`)
+
+// No default Staff grants — this app writes guest PII to NewBook and holds
+// signed regcards, access is admin-assigned per role via the portal (same
+// convention as hvac/plant/wages/utilities).
+
+console.log('tablet-checkin app seeded.')
+await pool.end()