POS Section Rework — sidebar nav rework (prod)

12/12 prod test PASS on get-coffee (Pro) + lumiere-coffee (Starter). 59/59 regression green. 1 commit, no migration.

Expandable "Point of Sale" group in the dark sidebar — replaces the old flat Register + Orders OPERATIONS rows with one group: Registers / Sessions / Orders / Settings. Collapsed off-section, expands on click; auto-expands on any /pos route; the most-specific child wins the active highlight. Same component drives the desktop rail and the mobile drawer — verified on both tenants.
Permission-aware — the group needs nix_cafe.pos.view; each child is filtered by its own gate (Sessions → reports.view, Orders → orders.view, Settings → settings.view). Owner happy path confirmed on prod; the filtering edge cases (cashier → just Registers, no pos.view → no group) were unit-tested at Gate 1.
In-page rail removed — pos-nav.tsx + pos-shell.tsx deleted; pos/layout.tsx simplified to a plain requirePermission passthrough. Prod confirms no pos-nav / pos-shell renders on /cafe/pos, and the ?config= register terminal still renders.
Page header re-added — the "Point of Sale" h1 the deleted shell owned is back on the landing.
Nav model extracted — buildNav + filterNavForPermissions + the nav types moved to a new server-import-free components/layout/nav-model.ts, so the permission filtering is unit-testable directly.
Commit 1542077 — 8 files (2 deleted, 1 new, 5 edited), no migration.

Prod test — 12/12

✓ get-coffee (Pro) — SSO login
✓ get-coffee (Pro) — sidebar shows the "Point of Sale" group; collapsed off-section, expands on click
✓ get-coffee (Pro) — old flat "Register" / "Orders" OPERATIONS rows are gone
✓ get-coffee (Pro) — children navigate (Sessions → /cafe/pos/sessions)
✓ get-coffee (Pro) — /cafe/pos: own header, group auto-expands, no in-page rail
✓ get-coffee (Pro) — ?config= register terminal still renders
✓ lumiere-coffee (Starter) — SSO login
✓ lumiere-coffee (Starter) — sidebar shows the "Point of Sale" group; collapsed off-section, expands on click
✓ lumiere-coffee (Starter) — old flat "Register" / "Orders" OPERATIONS rows are gone
✓ lumiere-coffee (Starter) — children navigate (Sessions → /cafe/pos/sessions)
✓ lumiere-coffee (Starter) — /cafe/pos: own header, group auto-expands, no in-page rail
✓ lumiere-coffee (Starter) — ?config= register terminal still renders

Regression sweep — 59/59

✓ phase1                  11/11   route sweep + subscription
✓ phase2-sso-outdoor        6/6    cross-product SSO
✓ phase2-cafe-multishop     6/6    POS shop picker
✓ m1-shop-scoping          10/10   reports / shop scoping
✓ r7                       14/14   dashboard + manager sidebar
✓ r8                        4/4    auth/security (per-tenant scope)
✓ r1-2-landing              8/8    landing flow, no 5xx
                          ─────
                          59/59   green — 71/71 effective with the 12/12 above

phase1 passed clean this sweep (no SSO-hop flake). The r7 + r1-2-landing
suites exercise the sidebar on every page they visit — the new NavGroupItem
rendered without regression across both tenants.

Files — 8 touched, no migration

new:
  components/layout/nav-model.ts               buildNav + filterNavForPermissions + nav types
deleted:
  app/(authed)/pos/_components/pos-nav.tsx     the in-page rail
  app/(authed)/pos/_components/pos-shell.tsx   the in-page master-detail wrapper
edited:
  components/layout/sidebar.tsx                + expandable NavGroup support (NavGroupItem),
                                               imports the model from nav-model.ts
  app/(authed)/pos/layout.tsx                  PosShell/Suspense → plain requirePermission passthrough
  app/(authed)/pos/pos-landing.tsx             re-added the "Point of Sale" header
  app/(authed)/pos/page.tsx                    re-added the header to the empty state
  app/(authed)/pos/loading.tsx                 re-added the header skeleton