Add POS terminal category visibility system

Add posterminal and posterminalcategory tables to control which categories
are visible on each POS terminal. The existence of a row in
posterminalcategory means the category is visible on that terminal.

Store methods:
- posterminal.list/upsert/delete - CRUD for terminals
- posterminal.setOn/setOff - toggle single category on a terminal
- posterminal.setOnAll/setOffAll - toggle all categories on a terminal
- posterminal.getCategoryPosterminalIds - internal, used by category tree

The category tree (getTreeForCompany) now includes a posterminalIds array
on each node listing which terminals have that category enabled.

src/store/posterminal/upsert.js

@@ -0,0 +1,51 @@
+import { GET_BY_ID, CREATE, UPDATE } from '../../sql/posterminal.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+
+export default function upsert(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, input = {}) => {
+    const pairingpin = input.pairingpin?.trim();
+    if (!pairingpin) {
+      throw new Error('Invalid posterminal');
+    }
+    const token = input.token ?? null;
+    const id = input.id ?? null;
+
+    await access(googleAuthId, companyId);
+
+    if (id) {
+      const existing = await pool
+        .request()
+        .input('id', id)
+        .query(GET_BY_ID);
+
+      if (!existing.recordset[0] || existing.recordset[0].companyId !== companyId) {
+        throw new Error('Posterminal not found');
+      }
+
+      await pool
+        .request()
+        .input('id', id)
+        .input('companyId', companyId)
+        .input('token', token)
+        .input('pairingpin', pairingpin)
+        .query(UPDATE);
+
+      return { id, token, pairingpin };
+    }
+
+    const created = await pool
+      .request()
+      .input('companyId', companyId)
+      .input('token', token)
+      .input('pairingpin', pairingpin)
+      .query(CREATE);
+
+    return {
+      id: created.recordset[0].id,
+      token: created.recordset[0].token,
+      pairingpin: created.recordset[0].pairingpin,
+    };
+  };
+}