Add company-scoped brand and company settings API.

brand now carries a NOT NULL company_id (unique per (company_id, name))
with brand.list/upsert/delete backed by resolveCompanyAccess. Adds
companysetting key-value store (list/get/set/delete, frontend flag).

src/store/companysetting/list.js

@@ -0,0 +1,21 @@
+import {
+  LIST_BY_COMPANY,
+  LIST_BY_COMPANY_FRONTEND,
+} from '../../sql/companysetting.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+import shapeSetting from './shapeSetting.js';
+
+export default function list(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, { frontendOnly = false } = {}) => {
+    await access(googleAuthId, companyId);
+
+    const result = await pool
+      .request()
+      .input('companyId', companyId)
+      .query(frontendOnly ? LIST_BY_COMPANY_FRONTEND : LIST_BY_COMPANY);
+
+    return result.recordset.map(shapeSetting);
+  };
+}