Add server routes for companies, approvals, costs, and dashboard

New routes: companies, approvals, costs, dashboard, authz. New
services: companies, approvals, costs, dashboard, heartbeat,
activity-log. Add auth middleware and structured error handling.
Expand existing agent and issue routes with richer CRUD operations.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/authz.ts

@@ -0,0 +1,30 @@
+import type { Request } from "express";
+import { forbidden } from "../errors.js";
+
+export function assertBoard(req: Request) {
+  if (req.actor.type !== "board") {
+    throw forbidden("Board access required");
+  }
+}
+
+export function assertCompanyAccess(req: Request, companyId: string) {
+  if (req.actor.type === "agent" && req.actor.companyId !== companyId) {
+    throw forbidden("Agent key cannot access another company");
+  }
+}
+
+export function getActorInfo(req: Request) {
+  if (req.actor.type === "agent") {
+    return {
+      actorType: "agent" as const,
+      actorId: req.actor.agentId ?? "unknown-agent",
+      agentId: req.actor.agentId ?? null,
+    };
+  }
+
+  return {
+    actorType: "user" as const,
+    actorId: req.actor.userId ?? "board",
+    agentId: null,
+  };
+}