Add demo tenant reseed, staff roles, and fix masquerade redirect

Demo Tenant:
- Add block_emails field to Tenant model for demo accounts
- Add is_email_blocked() and wrapper functions in email_service
- Create reseed_demo management command with salon/spa theme
- Add Celery beat task for daily reseed at midnight UTC
- Create 100 appointments, 20 customers, 13 services, 12 resources

Staff Roles:
- Add StaffRole model with permission toggles
- Create default roles: Full Access, Front Desk, Limited Staff
- Add StaffRolesSettings page and hooks
- Integrate role assignment in Staff management

Bug Fixes:
- Fix masquerade redirect using wrong role names (tenant_owner vs owner)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

frontend/src/App.tsx

@@ -133,6 +133,7 @@ const CommunicationSettings = React.lazy(() => import('./pages/settings/Communic
 const BillingSettings = React.lazy(() => import('./pages/settings/BillingSettings'));
 const QuotaSettings = React.lazy(() => import('./pages/settings/QuotaSettings'));
 const BusinessHoursSettings = React.lazy(() => import('./pages/settings/BusinessHoursSettings'));
+const StaffRolesSettings = React.lazy(() => import('./pages/settings/StaffRolesSettings'));
 
 import { Toaster } from 'react-hot-toast'; // Import Toaster for notifications
 
@@ -953,6 +954,7 @@ const AppContent: React.FC = () => {
                 <Route path="email-templates" element={<SystemEmailTemplates />} />
                 <Route path="custom-domains" element={<CustomDomainsSettings />} />
                 <Route path="api" element={<ApiSettings />} />
+                <Route path="staff-roles" element={<StaffRolesSettings />} />
                 <Route path="authentication" element={<AuthenticationSettings />} />
                 <Route path="email" element={<EmailSettings />} />
                 <Route path="sms-calling" element={<CommunicationSettings />} />