fix: align dashboard guard with fallback menu access

apps/dashboard/src/components/layout/DashboardAccessGuard.tsx

@@ -19,6 +19,7 @@ type GeneratedMenuItem = {
 
 type EmployeeMenuResponse = {
   items: GeneratedMenuItem[]
+  subscriptionAccessLevel?: 'full' | 'limited' | 'read_only' | 'none'
 }
 
 type EmployeeProfileResponse = {
@@ -27,6 +28,27 @@ type EmployeeProfileResponse = {
   }
 }
 
+const ROLE_RANK: Record<string, number> = { OWNER: 3, MANAGER: 2, AGENT: 1 }
+const BASELINE_MENU_ROUTES = [
+  { route: '/', minRole: 'AGENT' },
+  { route: '/reservations', minRole: 'AGENT' },
+  { route: '/fleet', minRole: 'AGENT' },
+  { route: '/customers', minRole: 'AGENT' },
+  { route: '/reports', minRole: 'MANAGER' },
+  { route: '/billing', minRole: 'MANAGER' },
+  { route: '/settings', minRole: 'OWNER' },
+] as const
+
+function hasMinRole(employeeRole: string, minRole: string): boolean {
+  return (ROLE_RANK[employeeRole] ?? 0) >= (ROLE_RANK[minRole] ?? 0)
+}
+
+export function getBaselineInternalRoutes(role: string): string[] {
+  return BASELINE_MENU_ROUTES
+    .filter((item) => hasMinRole(role, item.minRole))
+    .map((item) => item.route)
+}
+
 export function flattenInternalRoutes(items: GeneratedMenuItem[]): string[] {
   const routes: string[] = []
 
@@ -41,6 +63,15 @@ export function flattenInternalRoutes(items: GeneratedMenuItem[]): string[] {
   return Array.from(new Set(routes))
 }
 
+export function resolveAllowedRoutes(menu: EmployeeMenuResponse, role: string): string[] {
+  const routes = flattenInternalRoutes(menu.items)
+  const shouldUseBaselineFallback =
+    menu.subscriptionAccessLevel !== 'none' &&
+    (routes.length === 0 || routes.every((route) => route === '/'))
+
+  return shouldUseBaselineFallback ? getBaselineInternalRoutes(role) : routes
+}
+
 export function isAllowedRoute(currentPath: string, allowedRoutes: string[]) {
   return allowedRoutes.some((route) => {
     if (route === '/') return currentPath === '/'
@@ -93,7 +124,12 @@ export default function DashboardAccessGuard({ children }: { children: React.Rea
           const menu = await apiFetch<EmployeeMenuResponse>('/auth/employee/menu')
           if (cancelled) return
 
-          const allowedRoutes = flattenInternalRoutes(menu.items)
+          if (menu.subscriptionAccessLevel === 'none') {
+            router.replace('/subscription')
+            return
+          }
+
+          const allowedRoutes = resolveAllowedRoutes(menu, employee.role)
           const redirectPath = resolveAccessRedirect(currentPath, allowedRoutes)
 
           if (redirectPath) {