feat: enable Entra ID authentication

- Enable Better Auth middleware (was bypassed with return NextResponse.next())
- Re-enable AuthProvider in root layout
- Add public routes for webhooks, sync, kiosk, QBO, legal, health endpoints
- Set Microsoft Entra ID credentials and production Better Auth URLs
- Hide Engagement and Admin nav sections from non-super-admins
- Fix auth DB columns: snake_case → camelCase for Better Auth compatibility
- Add twoFactorEnabled column to user table

components/navigation/app-navigation.tsx

@@ -38,6 +38,7 @@ import {
 } from '@/components/ui/navigation-menu';
 import { Button } from '@/components/ui/button';
 import { ThemeToggle } from '@/components/theme-toggle';
+import { useSession } from '@/lib/auth-client';
 
 interface NavItem {
   title: string;
@@ -190,12 +191,23 @@ const navigationItems: NavItem[] = [
 
 export function AppNavigation() {
   const pathname = usePathname();
+  const { data: session } = useSession();
+  const userRole = (session?.user as any)?.role || 'user';
+  const isSuperAdmin = userRole === 'super-admin';
 
   const isActive = (href?: string) => {
     if (!href) return false;
     return pathname === href || pathname.startsWith(href + '/');
   };
 
+  // Hide Engagement and Admin from non-super-admins
+  const visibleItems = navigationItems.filter((item) => {
+    if (item.title === 'Engagement' || item.title === 'Admin') {
+      return isSuperAdmin;
+    }
+    return true;
+  });
+
   return (
     <header className="sticky top-0 z-50 w-full border-b bg-background/95 backdrop-blur supports-[backdrop-filter]:bg-background/60">
       <div className="container mx-auto px-6 flex h-16 items-center justify-between">
@@ -215,7 +227,7 @@ export function AppNavigation() {
         {/* Main Navigation — centered */}
         <NavigationMenu>
             <NavigationMenuList>
-              {navigationItems.map((item) => (
+              {visibleItems.map((item) => (
                 <NavigationMenuItem key={item.title}>
                   {item.children ? (
                     <>