Integra módulo de Resellers (agente eden-commercial)

Resolve conflitos de merge (users.ts, audit.ts, br-documents.ts,
pnpm-lock/workspace.yaml — o worktree partiu de uma base anterior à
existência do módulo de auth/companies, então recriou versões próprias
de arquivos que já existiam no main; mantido o conteúdo do main,
incorporando só a função nova assignUserToReseller). Adiciona
resellersRepo ao barrel @eden/database e ResellersModule ao app.module.ts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/database/migrations/1788439142825_resellers.cjs

@@ -0,0 +1,59 @@
+/**
+ * Commercial bounded context, first slice: `resellers` — the operational
+ * reseller/partner registry (eden.md §1.7). Pre-dates the "Programa de
+ * Canais" approval workflow with public tokens described in eden.md §6 —
+ * that workflow (client_registrations/reseller_registrations, public
+ * approval tokens) is explicitly out of scope for this migration and
+ * lands in its own later phase. This is just the simple operational CRUD
+ * table eden.md §1.7 describes, already referenced by `quotes.reseller_id`
+ * conceptually (quotes themselves aren't modeled yet either — Commercial
+ * phase lands module by module).
+ *
+ * Also adds `users.reseller_id` (nullable) — how a user gets scoped to a
+ * reseller, per eden.md §7 and the `scope=reseller` permission model
+ * (docs/adr/0004-permission-model.md). Lives in this migration rather
+ * than a separate one so the FK to `resellers(id)` can be added in the
+ * same statement the table is created in, without a two-step migration.
+ */
+
+exports.shorthands = undefined;
+
+exports.up = (pgm) => {
+  pgm.sql(`
+    CREATE TABLE resellers (
+      id             UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      created_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
+      updated_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
+      created_by     UUID REFERENCES users(id),
+      name           TEXT NOT NULL,
+      document       TEXT,
+      contact_email  TEXT,
+      active         BOOLEAN NOT NULL DEFAULT true
+    );
+    COMMENT ON TABLE resellers IS
+      'Cadastro operacional de revenda — eden.md §1.7. document é CPF/CNPJ livre (sem CHECK de dígito no banco, validado na camada de aplicação, igual companies.cnpj). Leitura aberta a qualquer autenticado (usado em seletores, ex. Orçamentos); escrita restrita à permissão resellers:edit.';
+
+    CREATE TRIGGER trg_resellers_updated_at BEFORE UPDATE ON resellers
+      FOR EACH ROW EXECUTE FUNCTION set_updated_at();
+
+    CREATE INDEX idx_resellers_active ON resellers(active);
+
+    -- =====================================================================
+    -- users.reseller_id — scopes a user to a reseller (eden.md §7,
+    -- docs/adr/0004-permission-model.md scope=reseller)
+    -- =====================================================================
+    ALTER TABLE users ADD COLUMN reseller_id UUID REFERENCES resellers(id);
+    COMMENT ON COLUMN users.reseller_id IS
+      'Nullable — vincula o usuário a uma revenda (vendedor de revenda), escopando o que ele vê (eden.md §7). Atribuído via PATCH /v1/resellers/:id/assign-user, nunca aceito de campo vindo do cliente para decisão de autorização (docs/architecture.md, ADR-0004).';
+
+    CREATE INDEX idx_users_reseller ON users(reseller_id);
+  `);
+};
+
+exports.down = (pgm) => {
+  pgm.sql(`
+    DROP INDEX IF EXISTS idx_users_reseller;
+    ALTER TABLE users DROP COLUMN IF EXISTS reseller_id;
+    DROP TABLE IF EXISTS resellers;
+  `);
+};