chore: commit pending admin-panel, api auth and parity doc changes

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>

apps/api/src/modules/admin-customers/admin-customers.controller.ts

@@ -1,7 +1,7 @@
 import { Body, Controller, Get, HttpCode, Param, Post, Put } from '@nestjs/common';
 import { AdminCustomersService, type OmdeScope } from './admin-customers.service';
 import { TableQueryDto } from '../admin-table/table-query.dto';
-import { CurrentAdmin, RequirePermission } from '../auth/guards';
+import { CurrentAdmin, RequirePermission, SuperAdminOnly } from '../auth/guards';
 import type { AuthenticatedAdmin } from '../auth/jwt.strategy';
 
 /**
@@ -31,6 +31,7 @@ export class AdminCustomersController {
 
   @Post('banker/list')
   @HttpCode(200)
+  @SuperAdminOnly()
   @RequirePermission('persons.list.client.omde')
   listBanker(@Body() query: TableQueryDto) {
     return this.list(query, 'banker');
@@ -38,6 +39,7 @@ export class AdminCustomersController {
 
   @Post('shopkeeper/list')
   @HttpCode(200)
+  @SuperAdminOnly()
   @RequirePermission('persons.list.client.omde')
   listShopkeeper(@Body() query: TableQueryDto) {
     return this.list(query, 'shopkeeper');
@@ -60,6 +62,7 @@ export class AdminCustomersController {
   /** Legacy POST single-customer — the retail customer list. */
   @Post('single/list')
   @HttpCode(200)
+  @SuperAdminOnly({ allowBranch: true })
   @RequirePermission('persons.list.client.single')
   listSingle(@Body() query: TableQueryDto, @CurrentAdmin() admin: AuthenticatedAdmin) {
     return this.customers.listSingle(query, admin.branchId ?? undefined);
@@ -68,6 +71,7 @@ export class AdminCustomersController {
   /** Legacy `POST single` — singleCustomer.vue, the retail customer form. */
   @Post('single')
   @HttpCode(200)
+  @SuperAdminOnly({ allowBranch: true })
   @RequirePermission('persons.create')
   createSingle(@Body() data: Record<string, unknown>) {
     return this.customers.createSingle(data);