feat(territories): role-gated attribution per territory kind - #365

Closes #147 — phase 5 of the role-based permission epic (#142).

Each territory kind now declares which roles a publisher must hold to be attributed a territory of that kind. The attribution pickers filter to matching publishers, and the server rejects a non-matching one posted directly at the route.

Two commits

chore(territories): rename TerritoryKind enum to TerritoryKindKey — mechanical, no behaviour change. Frees the name for the entity table. Enum values and their @map strings are unchanged, so Territory.type keeps its data and the migration is a Postgres type rename.

feat(territories): role-gated attribution per territory kind — the feature.

Design notes

The TerritoryKind entity, not an enum-keyed join. #147 specced TerritoryKindRole(kind, congregationId, roleId). Since kinds will eventually be user-created, a Prisma enum can't hold them, so this introduces the real table and hangs the role links off it: when custom kinds land, that table grows a name/slug and drops the enum column, and the join rows are untouched. Territory.type deliberately stays on TerritoryKindKey — pointing it at the FK is a later change.

The gate lives in the createAttribution / updateAttribution delegators, not in the aggregate. Those two are called only by the attribution routes, so a direct POST cannot slip past — while campaign-lifecycle.workflow, which calls attributionAggregate.assign directly, stays exempt by construction. That sweep re-attributes a pairing that already existed and swallows ConflictError, so gating it would silently strip a publisher's territory when a kind's roles change. An integration test guards that exemption.

An unchanged publisher on an edit passes. Otherwise tightening a kind's roles would make every existing attribution unsavable. The edit picker keeps the current publisher listed for the same reason.

What landed

• TerritoryKind + TerritoryKindAllowedRole with RLS policies and a compound FK so a kind can never be linked across tenants. The migration seeds the five built-ins for existing congregations; seedBuiltInTerritoryKinds covers new ones, injected into seedCongregationDefaults the way seedTemplates already was.
• Services written test-first: territory-kinds.server.ts, territory-kinds.queries.ts, attributable-publishers.queries.ts, attribution-eligibility.policy.ts. Eligibility resolves through findMembersWithAnyRole, the canonical helper that unions identity roles on MemberRoleAssignment with the account's custom roles.
• Settings → Territoires: "Types de territoires" is now one row per kind with a RolePicker; the Phone activation switch moved into its own row. Extracting DurationInput alongside it left settings.tsx at 314 lines, under the 351 it was grandfathered at.
• Archive parity: both tables round-trip through export/import. IMPORT_TOTAL_STEPS 41 → 43, caught by its own guard test.
• New AuditAction.TerritoryKindAllowedRolesChanged, emitted with the added/removed diff.

Verification

3153 unit tests, 334 integration tests, lint, typecheck, and all six architecture guards pass. 11 new integration tests cover persistence, RLS isolation across congregations, cascade when a role is deleted, seeding, and the campaign-sweep exemption.

Browser QA against the demo congregation: the picker dropped 45 publishers to the 5 elders on a restricted Phone territory; an unrestricted kind still listed everyone; a direct POST with a non-elder returned 409 with the field error and wrote nothing; an unchanged non-elder saved fine; changing to another non-elder was rejected.

Out of scope

• Per-kind enable/disable switches. Only Phone has an activation setting today (phone-territory-active, read in 16 places); moving it onto TerritoryKind.active is a follow-up that has to rewire those call sites.
• Pointing Territory.type at the new FK, and user-created kinds.
• Per-territory role overrides (the issue's option 2).

Worth a follow-up

The settings page renders the full role chip list once per kind. On a congregation with ~20 roles that is a tall wall of chips — a collapsed-by-default row would read better.