feat(03-01): Zone schema, migration, and tenant scoping

- Add Zone model (id, tenantId, name, description, isActive)
- Add ZoneAssignment model (collector-to-zone join table)
- Replace Subscriber.zone String? with Subscriber.zoneId FK to Zone
- Add Zone + ZoneAssignment to TENANT_SCOPED_MODELS with full operation blocks
- Add "Zone" to AppSubjects in types.ts
- Grant OFFICE_STAFF manage Zone, COLLECTOR read Zone in permissions.ts
- Migration 20260305000000_add_zones applied to DB

src/lib/casl/permissions.ts

@@ -51,6 +51,8 @@ export function definePermissionsFor(
       can("manage", "Invoice");
       // Record payments
       can("manage", "Payment");
+      // Zone management (assign subscribers and collectors to zones)
+      can("manage", "Zone");
       // Ticketing
       can("manage", "Ticket");
       // Job order management
@@ -69,6 +71,8 @@ export function definePermissionsFor(
     case Role.COLLECTOR: {
       // Can view all subscribers for context (zone filtering done at data layer)
       can("read", "Subscriber");
+      // Can read zones they are assigned to (data layer enforces which zones)
+      can("read", "Zone");
       // Can record payments (zone filtering done at data layer)
       can("create", "Payment");
       // View payment history