Add POS terminal category visibility system

Add posterminal and posterminalcategory tables to control which categories
are visible on each POS terminal. The existence of a row in
posterminalcategory means the category is visible on that terminal.

Store methods:
- posterminal.list/upsert/delete - CRUD for terminals
- posterminal.setOn/setOff - toggle single category on a terminal
- posterminal.setOnAll/setOffAll - toggle all categories on a terminal
- posterminal.getCategoryPosterminalIds - internal, used by category tree

The category tree (getTreeForCompany) now includes a posterminalIds array
on each node listing which terminals have that category enabled.

README.md

@@ -182,6 +182,37 @@ Company-scoped brands. Auth via `resolveCompanyAccess`.
 
 ---
 
+## `posterminal`
+
+Company-scoped POS terminals. Auth via `resolveCompanyAccess`.
+
+| Method | Signature | Returns |
+| --- | --- | --- |
+| `list` | `(googleAuthId, companyId)` | `{ id, token, pairingpin }[]` |
+| `upsert` | `(googleAuthId, companyId, { id?, token?, pairingpin })` | `{ id, token, pairingpin }` |
+| `delete` | `(googleAuthId, companyId, id)` | `void` |
+| `setOn` | `(googleAuthId, companyId, posterminalId, categoryId)` | `{ id, categoryIds[] }` |
+| `setOff` | `(googleAuthId, companyId, posterminalId, categoryId)` | `{ id, categoryIds[] }` |
+| `setOnAll` | `(googleAuthId, companyId, posterminalId)` | `{ id, categoryIds[] }` |
+| `setOffAll` | `(googleAuthId, companyId, posterminalId)` | `{ id, categoryIds[] }` |
+| `getCategoryPosterminalIds` | `(companyId)` | `{ [categoryId]: posterminalId[] }` (internal, used by category tree) |
+
+`posterminal.company_id` **NOT NULL**. `token` is nullable and unique (pairing code assigned during setup). `pairingpin` is required.
+
+`upsert`: if `id` is provided, updates the existing posterminal (must belong to company); otherwise creates a new one. Errors: `Company not found`, `Not authorized`, `Invalid posterminal`, `Posterminal not found`.
+
+`setOn` / `setOff`: toggle a single category's visibility on a single terminal. `setOn` inserts the row (idempotent — no error if already present); `setOff` deletes it (idempotent). Both return the updated `categoryIds` for that terminal. Errors: `Company not found`, `Not authorized`, `Posterminal not found`, `Invalid posterminal or category`.
+
+`setOnAll` / `setOffAll`: toggle **all** company categories on a single terminal. `setOnAll` walks the company's category tree and inserts any missing links; `setOffAll` removes all category links for the terminal. Both return the updated `categoryIds` for that terminal. Errors: `Company not found`, `Not authorized`, `Posterminal not found`, `Invalid posterminal`.
+
+`delete` cascades to `posterminalcategory`. Errors: `Company not found`, `Not authorized`, `Posterminal not found`.
+
+### Category tree integration
+
+`getTreeForCompany` returns a `posterminalIds` array on each tree node — the list of posterminal ids (of the current company) for which that category is visible. A category with an empty `posterminalIds` array is visible on all terminals (or has no terminal-specific filtering).
+
+---
+
 ## `category`
 
 | Method | Signature | Returns |
@@ -335,6 +366,13 @@ res.set('Content-Type', thumb.contentType).send(thumb.buffer);
 | `GET /api/brand?companyId=` | `brand.list(googleAuthId, companyId)` |
 | `PUT /api/brand` | `brand.upsert(googleAuthId, companyId, { name, gsprpinfo? })` |
 | `DELETE /api/brand/:id` | `brand.delete(googleAuthId, companyId, id)` |
+| `GET /api/posterminal?companyId=` | `posterminal.list(googleAuthId, companyId)` |
+| `PUT /api/posterminal` | `posterminal.upsert(googleAuthId, companyId, { id?, token?, pairingpin })` |
+| `DELETE /api/posterminal/:id` | `posterminal.delete(googleAuthId, companyId, id)` |
+| `PUT /api/posterminal/:id/category/:categoryId` | `posterminal.setOn(googleAuthId, companyId, id, categoryId)` |
+| `DELETE /api/posterminal/:id/category/:categoryId` | `posterminal.setOff(googleAuthId, companyId, id, categoryId)` |
+| `PUT /api/posterminal/:id/categories` | `posterminal.setOnAll(googleAuthId, companyId, id)` |
+| `DELETE /api/posterminal/:id/categories` | `posterminal.setOffAll(googleAuthId, companyId, id)` |
 | `POST /api/article` | `article.createUnderParent({ googleAuthId, parentId, name })` |
 | `GET /api/article/:sku` | `article.getBySku(googleAuthId, sku)` |
 | `PATCH /api/article/:sku` | `article.updateBySku(googleAuthId, sku, { name?, unitamount?, unitSi? })` |