fix: refresh token re-reads role from DB; remove staff stats cards

- /api/auth/refresh now fetches current role from DB instead of using
  stale Redis payload — role changes now take effect on next page refresh
  without requiring re-login. Also deactivates token if user.active=false.
- Removed role-count stat cards from staff page (user request)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/routes/auth.ts

@@ -291,11 +291,32 @@ const auth: FastifyPluginAsync = async (fastify) => {
     const stored = await redis.get(`refresh:${refreshToken}`)
     if (!stored) return reply.code(401).send({ error: 'Invalid or expired refresh token' })
 
-    const payload = JSON.parse(stored) as JwtPayload
-    const accessToken = fastify.jwt.sign(payload, {
-      expiresIn: config.jwt.accessExpiry,
-    })
+    const cached = JSON.parse(stored) as JwtPayload
 
+    // Re-read role and active status from DB so role changes take effect immediately
+    const { rows } = await db.query(
+      `SELECT u.role, u.active, h.slug AS hotel_slug
+         FROM users u
+         LEFT JOIN hotels h ON h.id = u.hotel_id
+        WHERE u.id = $1`,
+      [cached.sub],
+    )
+    if (!rows[0] || !rows[0].active) {
+      await redis.del(`refresh:${refreshToken}`)
+      reply.clearCookie('refresh_token', { path: '/api/auth' })
+      return reply.code(401).send({ error: 'Account inactive or not found' })
+    }
+
+    const payload: JwtPayload = {
+      ...cached,
+      role:      rows[0].role,
+      hotelSlug: rows[0].hotel_slug ?? cached.hotelSlug,
+    }
+    // Update Redis with fresh payload
+    const ttl = await redis.ttl(`refresh:${refreshToken}`)
+    if (ttl > 0) await redis.set(`refresh:${refreshToken}`, JSON.stringify(payload), 'EX', ttl)
+
+    const accessToken = fastify.jwt.sign(payload, { expiresIn: config.jwt.accessExpiry })
     return { access_token: accessToken }
   })