feat(GRO-106): staff messages page

- Adds staff conversations API (GET /api/conversations, GET /api/conversations/:id/messages, POST /api/conversations/:id/messages) with auth scoping and cross-tenant protection
- Adds staffReadAt column to conversations table for unread tracking
- Adds staff Messages page with two-column inbox layout (thread list + conversation view + composer)
- Adds Messages entry to staff sidebar navigation
- Includes tests for the MessagesPage component

Part of GRO-106 (SMS/MMS integration) Phase 1.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/web/src/App.tsx

@@ -4,6 +4,7 @@ import { AppointmentsPage } from "./pages/Appointments.js";
 import { ClientsPage } from "./pages/Clients.js";
 import { ClientDetailPage } from "./pages/ClientDetailPage.js";
 import { ServicesPage } from "./pages/Services.js";
+import { MessagesPage } from "./pages/Messages.js";
 import { StaffPage } from "./pages/Staff.js";
 import { InvoicesPage } from "./pages/Invoices.js";
 import { BookPage } from "./pages/Book.js";
@@ -170,6 +171,7 @@ function LoginPage() {
 
 const NAV_LINKS = [
   { to: "/admin", label: "Appointments" },
+  { to: "/admin/messages", label: "Messages" },
   { to: "/admin/clients", label: "Clients" },
   { to: "/admin/services", label: "Services" },
   { to: "/admin/staff", label: "Staff" },
@@ -296,6 +298,7 @@ function AdminLayout() {
       <main style={{ padding: "1.25rem 1.5rem" }}>
         <Routes>
           <Route path="/" element={<AppointmentsPage />} />
+          <Route path="/messages" element={<MessagesPage />} />
           <Route path="/clients" element={<ClientsPage />} />
           <Route path="/clients/:clientId" element={<ClientDetailPage />} />
           <Route path="/services" element={<ServicesPage />} />