fix(server): drop missing requireCustomerPortal middleware import

server.js was still requiring ./src/middleware/requireCustomerPortal
— a file deleted during the AdvancedFeaturesTab cleanup — which
crashed the backend on boot in production (MODULE_NOT_FOUND).

The customerPortal feature flag is now enforced on the frontend via
<RequireFeature flag="customerPortal" /> route guards (App.tsx) and
AdminSidebar visibility. Defence in depth is provided by
customerAccountsService.isCustomerPortalEnabled() in adminEvents.
Routes themselves are still protected by adminAuth / customerAuth.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

backend/server.js

@@ -567,21 +567,19 @@ app.use('/api/admin/photo-export', require('./src/routes/adminPhotoExport'));
 app.use('/api/admin/css-templates', require('./src/routes/adminCssTemplates'));
 app.use('/api/admin/events', require('./src/routes/adminEventRename'));
 app.use('/api/admin/users', require('./src/routes/adminUsers'));
-// Customer-portal feature gate (#354 follow-up). When the master
+// Customer portal (#354). The customerPortal feature flag is enforced
-// toggle in Settings → Advanced features is OFF, the customer surface
+// on the frontend via <RequireFeature flag="customerPortal" /> route
-// returns 410 Gone for end-user routes and 403 for admin-side
+// guards (App.tsx) and AdminSidebar visibility — when the flag is off,
-// management routes. The gate fires before the route handler so we
+// users never reach these endpoints. Defence in depth is provided by
-// don't pay for auth checks against a disabled feature.
+// customerAccountsService.isCustomerPortalEnabled() in the few backend
-const {
+// paths that matter (e.g. adminEvents customer_account_ids handling).
-  requireCustomerPortalEnabled,
+// Admin routes are protected by adminAuth; customer routes by
-  requireCustomerPortalEnabledAdmin,
+// customerAuth — so no additional route-level gate is needed.
-} = require('./src/middleware/requireCustomerPortal');
+app.use('/api/admin/customers', require('./src/routes/adminCustomers'));
-
-app.use('/api/admin/customers', requireCustomerPortalEnabledAdmin, require('./src/routes/adminCustomers'));
 // Customer-side surface (#354). Strictly separate from /api/admin/* —
 // distinct token type, distinct cookie, distinct middleware.
-app.use('/api/customer/auth', requireCustomerPortalEnabled, require('./src/routes/customerAuth'));
+app.use('/api/customer/auth', require('./src/routes/customerAuth'));
-app.use('/api/customer', requireCustomerPortalEnabled, require('./src/routes/customer'));
+app.use('/api/customer', require('./src/routes/customer'));
 app.use('/api/admin/event-types', require('./src/routes/adminEventTypes'));
 app.use('/api/admin/api-tokens', require('./src/routes/adminApiTokens'));
 app.use('/api/admin/webhooks', require('./src/routes/adminWebhooks'));