Add company-scoped brand and company settings API.

brand now carries a NOT NULL company_id (unique per (company_id, name))
with brand.list/upsert/delete backed by resolveCompanyAccess. Adds
companysetting key-value store (list/get/set/delete, frontend flag).

src/store/companysetting/set.js

@@ -0,0 +1,36 @@
+import { GET_BY_COMPANY_AND_KEY, UPSERT } from '../../sql/companysetting.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+import shapeSetting from './shapeSetting.js';
+
+export default function set(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, input = {}) => {
+    const key = input.key?.trim();
+    if (!key) {
+      throw new Error('Invalid setting');
+    }
+    if (typeof input.value !== 'string') {
+      throw new Error('Invalid setting');
+    }
+
+    const frontend = Boolean(input.frontend);
+    await access(googleAuthId, companyId);
+
+    await pool
+      .request()
+      .input('companyId', companyId)
+      .input('key', key)
+      .input('value', input.value)
+      .input('frontend', frontend)
+      .query(UPSERT);
+
+    const result = await pool
+      .request()
+      .input('companyId', companyId)
+      .input('key', key)
+      .query(GET_BY_COMPANY_AND_KEY);
+
+    return shapeSetting(result.recordset[0]);
+  };
+}