Dashboard-API: Center-Scoping (Listen)

List endpoints use the same layer:

1. Explicit Center: ?centerId=<uuid> → for logged-in users assertCenterAccess; without login, restriction to this center only (e.g., kiosk/proxy with ?centerId=).
2. No centerId in the URL: Session required; buildCenterFilter(session) → params.centerIds.
3. pickCenterWhereFragment / createStandardWhereClause in lib/api/utils.ts map to Prisma: centerId or centerId: { in: [...] }. Empty centerIds → no matches.

Server Helper: mergeSessionCenterScopeIntoListParams in apps/dashboard/src/lib/api/list-route-center-scope.ts — call before findMany (including GET /api/events, /api/jobs, /api/services, Hot-Picks, /api/content/metrics, /api/content/recent). Manual Prisma routes use pickCenterWhereFragment for the center fragment of the where clause.

Notes

• The placeholder all should not be in the query. centerIdQueryParam in apps/dashboard/src/lib/center-query.ts; extractQueryParams discards ?centerId=all.
• GET /api/offers continues to build the session filter directly into Prisma (same semantics).
• News/Shops: createStandardWhereClause (uses pickCenterWhereFragment).

This keeps dashboard lists consistent when changing centers or "All Centers" (Super Admin).

Related: Audit: Namespace /api/content/* — which routes still have CORS/without session and who calls them.