Add demo tenant reseed, staff roles, and fix masquerade redirect

Demo Tenant:
- Add block_emails field to Tenant model for demo accounts
- Add is_email_blocked() and wrapper functions in email_service
- Create reseed_demo management command with salon/spa theme
- Add Celery beat task for daily reseed at midnight UTC
- Create 100 appointments, 20 customers, 13 services, 12 resources

Staff Roles:
- Add StaffRole model with permission toggles
- Create default roles: Full Access, Front Desk, Limited Staff
- Add StaffRolesSettings page and hooks
- Integrate role assignment in Staff management

Bug Fixes:
- Fix masquerade redirect using wrong role names (tenant_owner vs owner)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

frontend/src/hooks/useAuth.ts

@@ -122,9 +122,11 @@ export const useIsAuthenticated = (): boolean => {
 /**
  * Get the redirect path based on user role
  * Tenant users go to /dashboard/, platform users go to /
+ * Note: Backend maps tenant_owner -> owner, tenant_manager -> manager, etc.
  */
 const getRedirectPathForRole = (role: string): string => {
-  const tenantRoles = ['tenant_owner', 'tenant_manager', 'tenant_staff'];
+  // Tenant roles (as returned by backend after role mapping)
+  const tenantRoles = ['owner', 'manager', 'staff', 'customer'];
   if (tenantRoles.includes(role)) {
     return '/dashboard/';
   }