Session::has() is `! is_null(get($key))`, so it reports false for a key
holding null — which is exactly how "all branches" was stored. Three
call sites tested presence that way, so selecting كل الفروع silently
reverted to a single branch on the next navigation and isAllBranches()
was unreachable dead code. All three now use exists().

BranchContext is the one place that reads that state. It lives in
Context, not Services, because the project rule keeps services free of
session/auth so they stay queue-safe; this is the adapter that turns
request state into the explicit ?int $branchId services receive. A null
left by a user whose permission was revoked is repaired rather than
honoured, and stamping deliberately does not follow branchId() — API
routes and queued listeners run outside the request, and a record filed
against no branch would vanish from every per-branch total for good.

The lock itself is dormant on purpose: isLocked() returns false while
the executive dashboard route does not exist, since locking would
otherwise 500 every page including its own redirect target. The
permission ships as a migration as well as a seeder entry, because
db:seed only runs when RUN_SEED_ON_FIRST_DEPLOY is set.

Also stops enabling the query log outside debug — it retained every
statement of every request in production memory for nothing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>