## What we're building

You've already got the core HRM pieces (Domains, Brands, Services, Users, Payments, Card Usage). This plan fills in the workflow gap: a **public form** sales reps submit → lands in a **review queue** → admin **approves** → row moves into `domains` → **emails fire** to admin and submitter.

## 1. Roles (admin vs sales rep)

Add a proper `user_roles` table with an `app_role` enum (`admin`, `sales`, `user`) and a `has_role(uuid, app_role)` security-definer function. The first sign-up is auto-promoted to `admin`; everyone after defaults to `sales`. This drives who can see the review queue and who can edit Services / Payments / Card Usage.

## 2. Public submission flow

New table `public.domain_requests` mirroring the fields from your sample sheet (domain name, registration tenure, domain for, buying as, your name, brand, email, customer name/email, comments, hosting purchased by client, expiry, requested amount). Status: `pending | approved | rejected`.

- New **public** route `/request-domain` (no login) — branded form, Zod-validated, writes one row.
- New **admin** route `/requests` — list pending, one-click **Approve** (inserts into `domains` + marks request approved) or **Reject** (with reason).

## 3. Email notifications

On submission and on approval/rejection:
- **Admin** gets a digest email (who submitted, brand, domain, link to review)
- **Submitter** gets a confirmation ("we received your request") and a status update on approve/reject

This needs an email sender domain. I'll surface the email setup dialog so you can configure that (~2 min, DNS records). Until DNS verifies, submissions still save — emails just queue and send once active.

## 4. Navigation & guards

- Sidebar gets a **Requests** tab (admin-only, badge with pending count).
- Services / Payments / Card Usage edit actions become admin-only; sales reps see read-only.
- Existing pages keep working.

## Technical notes

- Tables: `user_roles` (with enum + `has_role` fn), `domain_requests` (RLS: `anon INSERT`, admin `SELECT/UPDATE`).
- Trigger on new auth user → insert into `user_roles` (admin if first user, else sales).
- Server function `approveDomainRequest` (admin-only) does the insert into `domains` + status flip + enqueues emails.
- Public form posts via a server route (`/api/public/domain-requests`) with Zod validation + rate limit by IP/email to prevent spam.
- Email templates: `domain-request-received` (submitter), `domain-request-new` (admin), `domain-request-decision` (submitter).

## Step right after you approve this plan

1. Run the migration (roles + domain_requests + trigger).
2. Show the email setup dialog so you can pick the sender subdomain.
3. Build all the UI + server functions + templates in one pass.
