Add per-event finance, event team permissions and public door sales state.

Event finance
- Finance tab on the event page: P&L summary with a revenue-to-result
  waterfall, costs and other income in one ledger, and the partner split
  with payouts. Lifecycle stepper (Selling, Adding costs, Ready to close,
  Finalized) with what is left to do; closing the books goes through a
  checklist dialog that freezes the numbers.
- Expense modal shows only the fields each calculation type needs, a live
  preview with the event's real counts, and a category suggested from the
  description. Date inputs follow the UI language.
- Global Finance page: profit per event with outliers clipped and labelled,
  and a "Ready to close" list of past events whose books are still open.
- Calculation service (integer PYG, basis points) with pinned regression
  scenarios; PYG formatting centralised in lib/money with locale-aware
  separators.

Event team permissions
- Per-event members with role presets and requireEventPermission; the
  header stat "Confirmed" is relabelled "Not checked in yet", which is
  what it counts.

Public sales state
- One sales state (online, door, sold out, ended, external, cancelled) for
  the event page, listings and JSON-LD, with the door price and tenders
  shown only while people can still pay at the door.

Frontend unit tests run with vitest (npm test in frontend/).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/app/admin/events/[id]/_hooks/useEventDetailData.ts

@@ -1,43 +1,81 @@
 import { useState, useEffect } from 'react';
 import toast from 'react-hot-toast';
-import { eventsApi, ticketsApi, emailsApi, doorApi, Event, Ticket, EmailTemplate, DoorSummary } from '@/lib/api';
+import { eventsApi, ticketsApi, emailsApi, doorApi, Event, Ticket, EmailTemplate, DoorSummary, type EventPermission } from '@/lib/api';
+
+/** A 403 means "not for this viewer": render without that data instead of failing the page. */
+const forbidden = (error: any) => error?.status === 403;
 
 /**
- * Loads the core data for the admin event detail page (event, tickets, active
- * email templates, door takings) and exposes a reload function used after
- * mutations.
+ * Loads the core data for the event detail page and exposes a reload function
+ * used after mutations. The event itself is fetched straight away so the
+ * header can render while the rest loads; tickets, active email templates and
+ * door takings wait for the viewer's permissions on the event and only request
+ * what they may see, so team members get a working page with fewer tabs.
+ *
+ * `eventLoading` and `detailsLoading` cover the first load only: reloads keep
+ * the current data on screen until the new data replaces it.
  */
-export function useEventDetailData(eventId: string) {
-  const [loading, setLoading] = useState(true);
+export function useEventDetailData(eventId: string, permissions: Set<EventPermission> | null) {
+  const [eventLoading, setEventLoading] = useState(true);
+  const [detailsLoading, setDetailsLoading] = useState(true);
   const [event, setEvent] = useState<Event | null>(null);
   const [tickets, setTickets] = useState<Ticket[]>([]);
   const [templates, setTemplates] = useState<EmailTemplate[]>([]);
   const [doorSummary, setDoorSummary] = useState<DoorSummary | null>(null);
 
-  const loadEventData = async () => {
+  const loadEvent = async () => {
     try {
-      const [eventRes, ticketsRes, templatesRes, doorRes] = await Promise.all([
-        eventsApi.getById(eventId),
-        ticketsApi.getAll({ eventId }),
-        emailsApi.getTemplates(),
+      const { event } = await eventsApi.getById(eventId);
+      setEvent(event);
+    } catch (error) {
+      toast.error('Failed to load event data');
+    } finally {
+      setEventLoading(false);
+    }
+  };
+
+  const loadDetails = async () => {
+    if (!permissions) return;
+    const can = (p: EventPermission) => permissions.has(p);
+    try {
+      const [ticketsRes, templatesRes, doorRes] = await Promise.all([
+        can('view_attendees_names')
+          ? ticketsApi.getAll({ eventId }).catch((error) => {
+            if (forbidden(error)) return { tickets: [] as Ticket[] };
+            throw error;
+          })
+          : { tickets: [] as Ticket[] },
+        can('email_attendees')
+          ? emailsApi.getTemplates(eventId).catch((error) => {
+            if (forbidden(error)) return { templates: [] as EmailTemplate[] };
+            throw error;
+          })
+          : { templates: [] as EmailTemplate[] },
         // Door takings split pre-sale from cash/bitcoin/transfer taken on the
         // night. It is supporting detail, so a failure here must not blank the page.
-        doorApi.summary(eventId).catch(() => null),
+        can('view_payments') ? doorApi.summary(eventId).catch(() => null) : null,
       ]);
-      setEvent(eventRes.event);
       setTickets(ticketsRes.tickets);
       setTemplates(templatesRes.templates.filter(t => t.isActive));
       setDoorSummary(doorRes);
     } catch (error) {
       toast.error('Failed to load event data');
     } finally {
-      setLoading(false);
+      setDetailsLoading(false);
     }
   };
 
+  const loadEventData = async () => {
+    await Promise.all([loadEvent(), loadDetails()]);
+  };
+
   useEffect(() => {
-    loadEventData();
+    loadEvent();
   }, [eventId]);
 
-  return { loading, event, tickets, templates, doorSummary, loadEventData };
+  useEffect(() => {
+    loadDetails();
+  }, [eventId, permissions]);
+
+  return { eventLoading, detailsLoading, event, tickets, templates, doorSummary, loadEventData };
 }