fix(gro-48): address QA review feedback — staffRow?.role and portal TS guards

- appointments.ts: use staffRow?.role (consistent with clients.ts/pets.ts)
  to handle undefined staff context safely
- portal.ts: add null guards on .returning() results for confirm and cancel
  endpoints (TS18048: 'updated' is possibly undefined)
- All 188 tests passing; TypeScript typecheck clean

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/routes/appointments.ts

@@ -73,7 +73,7 @@ appointmentsRouter.get("/", async (c) => {
   const to = c.req.query("to");
   const staffId = c.req.query("staffId");
   const staffRow = c.get("staff");
-  const isGroomer = staffRow.role === "groomer";
+  const isGroomer = staffRow?.role === "groomer";
 
   const conditions = [];
   if (from) conditions.push(gte(appointments.startTime, new Date(from)));
@@ -108,7 +108,7 @@ appointmentsRouter.get("/", async (c) => {
 appointmentsRouter.get("/:id", async (c) => {
   const db = getDb();
   const staffRow = c.get("staff");
-  const isGroomer = staffRow.role === "groomer";
+  const isGroomer = staffRow?.role === "groomer";
   const [row] = await db
     .select()
     .from(appointments)

apps/api/src/routes/portal.ts

@@ -134,6 +134,10 @@ portalRouter.post("/appointments/:id/confirm", async (c) => {
     .where(eq(appointments.id, id))
     .returning();
 
+  if (!updated) {
+    return c.json({ error: "Not found" }, 404);
+  }
+
   return c.json({
     id: updated.id,
     confirmationStatus: updated.confirmationStatus,
@@ -194,6 +198,10 @@ portalRouter.post("/appointments/:id/cancel", async (c) => {
     .where(eq(appointments.id, id))
     .returning();
 
+  if (!updated) {
+    return c.json({ error: "Not found" }, 404);
+  }
+
   return c.json({
     id: updated.id,
     status: updated.status,