feat: gate treasury as an org module and group money inputs

Link optional invoice and cheque settlements to cash accounts, and let superadmin enable the finance module per organization.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/auth/auth.service.ts

@@ -763,6 +763,7 @@ export class AuthService {
         organization: {
           select: { name: true, enabledModules: true, priorArchiveEnabledAt: true },
         },
+        orgRole: { select: { permissions: true } },
       },
     });
     const role = membership?.role ?? user.role;
@@ -790,6 +791,9 @@ export class AuthService {
       subscription: sub,
       isOrgOwner: role === 'owner',
       priorArchive: this.priorArchiveFor(membership),
+      permissions: (Array.isArray(membership?.orgRole?.permissions)
+        ? membership.orgRole.permissions.filter((item) => typeof item === 'string')
+        : []) as AuthUserDto['permissions'],
       ...(viewAs ? { viewAs } : {}),
     });
   }
@@ -897,6 +901,7 @@ export class AuthService {
     isOrgOwner?: boolean;
     priorArchive?: AuthUserDto['priorArchive'];
     viewAs?: AuthUserDto['viewAs'];
+    permissions?: AuthUserDto['permissions'];
   }): AuthUserDto {
     return {
       id: user.id,
@@ -912,6 +917,7 @@ export class AuthService {
       ...(user.isOrgOwner !== undefined ? { isOrgOwner: user.isOrgOwner } : {}),
       ...(user.priorArchive ? { priorArchive: user.priorArchive } : {}),
       ...(user.viewAs ? { viewAs: user.viewAs } : {}),
+      ...(user.permissions ? { permissions: user.permissions } : {}),
     };
   }
 }