Add demo tenant reseed, staff roles, and fix masquerade redirect

Demo Tenant:
- Add block_emails field to Tenant model for demo accounts
- Add is_email_blocked() and wrapper functions in email_service
- Create reseed_demo management command with salon/spa theme
- Add Celery beat task for daily reseed at midnight UTC
- Create 100 appointments, 20 customers, 13 services, 12 resources

Staff Roles:
- Add StaffRole model with permission toggles
- Create default roles: Full Access, Front Desk, Limited Staff
- Add StaffRolesSettings page and hooks
- Integrate role assignment in Staff management

Bug Fixes:
- Fix masquerade redirect using wrong role names (tenant_owner vs owner)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

frontend/src/layouts/SettingsLayout.tsx

@@ -22,6 +22,7 @@ import {
   AlertTriangle,
   Calendar,
   Clock,
+  Users,
 } from 'lucide-react';
 import {
   SettingsSidebarSection,
@@ -154,6 +155,12 @@ const SettingsLayout: React.FC = () => {
 
           {/* Access Section */}
           <SettingsSidebarSection title={t('settings.sections.access', 'Access')}>
+            <SettingsSidebarItem
+              to="/dashboard/settings/staff-roles"
+              icon={Users}
+              label={t('settings.staffRoles.title', 'Staff Roles')}
+              description={t('settings.staffRoles.description', 'Role permissions')}
+            />
             <SettingsSidebarItem
               to="/dashboard/settings/authentication"
               icon={Lock}