feat: complete SSR CRM and refine auth UI

examples/crm-app/app/api/deals.ts

@@ -0,0 +1,15 @@
+import { can } from "@wrnexus/authz";
+import { getDb } from "@wrnexus/db";
+import type { Context } from "@wrnexus/core";
+import { ensureCrmWorkspace } from "../lib/workspace.ts";
+
+export async function GET(ctx: Context): Promise<Response> {
+  if (!(await can(ctx, "deal:read"))) return Response.json({ error: "Forbidden" }, { status: 403 });
+  const owner = String((ctx.user as { id?: unknown } | undefined)?.id ?? "");
+  await ensureCrmWorkspace(owner);
+  const deals = await getDb().all(
+    "SELECT d.id,d.title,d.value_cents,d.stage,d.close_date,c.name contact_name FROM crm_deals d LEFT JOIN crm_contacts c ON c.id=d.contact_id WHERE d.owner_id=? ORDER BY d.updated_at DESC",
+    [owner],
+  );
+  return Response.json({ deals });
+}