perf(api): write routes stop re-resolving the active company (#1928)

* perf(api): write routes stop re-resolving the active company

withRouteContext resolves the active company (one resolve_active_company
RPC, ~40 ms p50 on prod) and then, for the 256 routes that pass
requireWrite: true, called requireWritePermission(), which resolved it a
second time before its role select. Two sequential round trips repeating
work the wrapper had just done, on every mutating request.

requireWritePermission() and getCompanyRole() now accept an optional
`known` context; the wrapper passes { companyId }, so the helper goes
straight to the membership select. Callers that pass nothing behave
exactly as before, and the shared selectRole() keeps both helpers on the
same query. The role is still looked up, never trusted from the caller.

Tests: known companyId skips resolution, known role skips the select, a
known viewer is still 403, a known company without a membership row is
still 403, legacy calls unchanged; new lib/api/__tests__/with-route-
context.test.ts pins that the wrapper resolves the company exactly once,
hands it to the guard, never calls the guard on read routes, passes the
guard's 403 through with a request id, and emits Server-Timing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(customers): viewer gate expects the wrapper to hand over the resolved company

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/api/with-route-context.ts

@@ -136,8 +136,11 @@ export function withRouteContext<P extends DynamicParams = { params: Promise<Rec
       if (requireWrite) {
         // Delegate to the existing helper so tests that already mock it
         // continue to work. The helper returns its own 403 NextResponse;
-        // we wrap it in our request-id header for traceability.
-        const writeCheck = await requireWritePermission(supabase, user.id)
+        // we wrap it in our request-id header for traceability. The
+        // company id resolved above is handed over so the helper does not
+        // repeat the resolve_active_company round trip (measured ~40 ms p50
+        // on prod) on every write route.
+        const writeCheck = await requireWritePermission(supabase, user.id, { companyId })
         if (!writeCheck.ok) {
           userLog.warn('write permission denied')
           if (!writeCheck.response.headers.get('X-Request-Id')) {