Fix UserController permission serialization and include current updates

prisma/schema.prisma

@@ -75,8 +75,9 @@ model Company {
   cw_CompanyId  Int    @unique
   cw_Identifier String @unique
 
-  credentials Credential[]
-  unifiSites  UnifiSite[]
+  credentials   Credential[]
+  unifiSites    UnifiSite[]
+  opportunities Opportunity[]
 
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
@@ -85,6 +86,7 @@ model Company {
 model CatalogItem {
   id                  String  @id @default(cuid())
   cwCatalogId         Int     @unique
+  identifier          String? @unique
   name                String
   description         String?
   customerDescription String?
@@ -115,6 +117,73 @@ model CatalogItem {
   updatedAt DateTime @updatedAt
 }
 
+model Opportunity {
+  id              String  @id @default(cuid())
+  cwOpportunityId Int     @unique
+  name            String
+  notes           String?
+
+  // Stage / status / priority / type / rating stored as JSON references
+  // so we don't need separate lookup tables for CW enums
+  typeName     String?
+  typeCwId     Int?
+  stageName    String?
+  stageCwId    Int?
+  statusName   String?
+  statusCwId   Int?
+  priorityName String?
+  priorityCwId Int?
+  ratingName   String?
+  ratingCwId   Int?
+  source       String?
+  campaignName String?
+  campaignCwId Int?
+
+  // Sales rep references
+  primarySalesRepName         String?
+  primarySalesRepIdentifier   String?
+  primarySalesRepCwId         Int?
+  secondarySalesRepName       String?
+  secondarySalesRepIdentifier String?
+  secondarySalesRepCwId       Int?
+
+  // Company / contact / site
+  companyCwId Int?
+  companyName String?
+  contactCwId Int?
+  contactName String?
+  siteCwId    Int?
+  siteName    String?
+  customerPO  String?
+
+  // Financials
+  totalSalesTax Float @default(0)
+
+  // Location / department
+  locationName   String?
+  locationCwId   Int?
+  departmentName String?
+  departmentCwId Int?
+
+  // Dates
+  expectedCloseDate  DateTime?
+  pipelineChangeDate DateTime?
+  dateBecameLead     DateTime?
+  closedDate         DateTime?
+  closedFlag         Boolean   @default(false)
+  closedByName       String?
+  closedByCwId       Int?
+
+  // Internal relation to Company (optional, linked by cwCompanyId)
+  companyId String?
+  company   Company? @relation(fields: [companyId], references: [id])
+
+  cwLastUpdated DateTime?
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+}
+
 model CredentialType {
   id   String @id @default(cuid())
   name String @unique