feat: add SQL query tool, platform debug, loyalty settings, and multi-module improvements

- Add admin SQL query tool with saved queries, schema explorer presets,
  and collapsible category sections (dev_tools module)
- Add platform debug tool for admin diagnostics
- Add loyalty settings page with owner-only access control
- Fix loyalty settings owner check (use currentUser instead of window.__userData)
- Replace HTTPException with AuthorizationException in loyalty routes
- Expand loyalty module with PIN service, Apple Wallet, program management
- Improve store login with platform detection and multi-platform support
- Update billing feature gates and subscription services
- Add store platform sync improvements and remove is_primary column
- Add unit tests for loyalty (PIN, points, stamps, program services)
- Update i18n translations across dev_tools locales

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/core/routes/api/store_dashboard.py

@@ -143,9 +143,11 @@ def get_onboarding_status(
     store_id = current_user.token_store_id
     store = store_service.get_store_by_id(db, store_id)
 
-    return onboarding_aggregator.get_onboarding_summary(
+    summary = onboarding_aggregator.get_onboarding_summary(
         db=db,
         store_id=store_id,
         platform_id=platform.id,
         store_code=store.store_code,
     )
+    summary["is_owner"] = current_user.role == "merchant_owner"
+    return summary

app/modules/core/routes/api/store_menu.py

@@ -100,7 +100,7 @@ async def get_rendered_store_menu(
     # Platform from JWT (set at login from URL context), fall back to DB for old tokens
     platform_id = current_user.token_platform_id
     if platform_id is None:
-        platform_id = menu_service.get_store_primary_platform_id(db, store.id)
+        platform_id = menu_service.get_store_fallback_platform_id(db, store.id)
 
     # Get filtered menu with platform visibility, store_code, and permission filtering
     menu = menu_service.get_menu_for_rendering(

app/modules/core/services/menu_service.py

@@ -422,7 +422,7 @@ class MenuService:
         Get the primary platform ID for a merchant's visibility config.
 
         Resolution order:
-        1. Platform from the store marked is_primary in StorePlatform
+        1. First active StorePlatform for the merchant's stores (by joined_at)
         2. First active subscription's platform (fallback)
 
         Args:
@@ -445,7 +445,7 @@ class MenuService:
 
         # Try primary store platform first
         for store in stores:
-            pid = platform_service.get_primary_platform_id_for_store(db, store.id)
+            pid = platform_service.get_first_active_platform_id_for_store(db, store.id)
             if pid is not None:
                 # Verify merchant has active subscription on this platform
                 active_pids = subscription_service.get_active_subscription_platform_ids(
@@ -460,16 +460,16 @@ class MenuService:
         )
         return active_pids[0] if active_pids else None
 
-    def get_store_primary_platform_id(
+    def get_store_fallback_platform_id(
         self,
         db: Session,
         store_id: int,
     ) -> int | None:
         """
-        Get the primary platform ID for a store's menu visibility config.
+        Get the fallback platform ID for a store's menu visibility config.
 
-        Prefers the active StorePlatform marked is_primary, falls back to
-        the first active StorePlatform by ID.
+        Returns the first active StorePlatform ordered by joined_at.
+        Used only when platform_id is not available from JWT context.
 
         Args:
             db: Database session
@@ -480,7 +480,7 @@ class MenuService:
         """
         from app.modules.tenancy.services.platform_service import platform_service
 
-        return platform_service.get_primary_platform_id_for_store(db, store_id)
+        return platform_service.get_first_active_platform_id_for_store(db, store_id)
 
     def get_merchant_for_menu(
         self,

app/modules/core/services/onboarding_aggregator.py

@@ -39,20 +39,6 @@ class OnboardingAggregatorService:
     a unified interface for the dashboard onboarding banner.
     """
 
-    def _get_store_platform_ids(self, db: Session, store_id: int) -> set[int]:
-        """Get platform IDs the store is actively subscribed to."""
-        from app.modules.tenancy.models.store_platform import StorePlatform
-
-        rows = (
-            db.query(StorePlatform.platform_id)
-            .filter(
-                StorePlatform.store_id == store_id,
-                StorePlatform.is_active.is_(True),
-            )
-            .all()
-        )
-        return {r.platform_id for r in rows}
-
     def _get_enabled_providers(
         self, db: Session, store_id: int, platform_id: int
     ) -> list[tuple["ModuleDefinition", OnboardingProviderProtocol]]:
@@ -68,10 +54,10 @@ class OnboardingAggregatorService:
         from app.modules.registry import MODULES
         from app.modules.service import module_service
 
-        store_platform_ids = self._get_store_platform_ids(db, store_id)
-        if not store_platform_ids:
-            # Fallback to the passed platform_id if no subscriptions found
-            store_platform_ids = {platform_id}
+        # Only check the current platform, not all subscribed platforms.
+        # This prevents cross-platform content leakage (e.g. showing OMS steps
+        # when logged in on the loyalty platform).
+        store_platform_ids = {platform_id}
 
         providers: list[tuple[ModuleDefinition, OnboardingProviderProtocol]] = []
 

app/modules/core/static/store/js/dashboard.js

@@ -19,6 +19,7 @@ function onboardingBanner() {
     return {
         t,
         visible: false,
+        isOwner: true,
         steps: [],
         totalSteps: 0,
         completedSteps: 0,
@@ -33,6 +34,7 @@ function onboardingBanner() {
             try {
                 const response = await apiClient.get('/store/dashboard/onboarding');
                 const steps = response.steps || [];
+                this.isOwner = response.is_owner !== false;
 
                 // Load module translations BEFORE setting reactive data
                 // Keys are like "tenancy.onboarding...." — first segment is the module