api-security

• Authentication: JWT + refresh tokens with session validation.
• Authorization: role-based access control with scope guards. Always use @UseGuards(AuthGuard, ScopeGuard).
• Scope: society/unit context is validated via the x-society-id, x-unit-id and x-membership-id headers: society-scope.
• Soft deletes: never expose deleted data; filter with deletedAt: null: soft-delete.
• Input validation: GraphQL schema + custom validators.
• Data access: services only, no direct database calls: prisma-access.
• Super admin: bypasses society requirements when appropriate. ScopeGuard allows it unless a resolver sets allowSuperAdminWithoutSociety: false.