Tax exemption certificates are validated where required

A tax exemption flag on the customer record that is granted without any certificate validation — no upload, no expiry check, no certificate number format validation — is an open door for fraudulent exemption claims. US state resale exemption certificate laws (and the Streamlined Sales Tax Agreement for member states) require sellers to retain a valid certificate to defend a tax-free sale during an audit. An expired 2019 resale certificate that still exempts a customer today invalidates the seller's audit defense: the state can assess tax plus penalties on every sale covered by an invalid certificate. CWE-682 applies when the exemption calculation returns $0 on the basis of unvalidated input.

Implement certificate validation in lib/tax-exemption.ts before granting exemption:

// lib/tax-exemption.ts
interface TaxExemptCertificate {
  id: string
  customerId: string
  certificateNumber: string
  issuerState: string
  expiryDate: Date
  fileUrl: string // uploaded scan
}

function isCertificateValid(cert: TaxExemptCertificate): boolean {
  const expired = new Date(cert.expiryDate) < new Date()
  const hasNumber = /^[A-Z0-9-]{5,20}$/.test(cert.certificateNumber)
  return !expired && hasNumber && Boolean(cert.fileUrl)
}

function getEffectiveTaxExempt(
  customer: Customer,
  cert: TaxExemptCertificate | null
): boolean {
  if (!customer.is_tax_exempt || !cert) return false
  return isCertificateValid(cert)
}

Add the certificate table migration and wire getEffectiveTaxExempt into the checkout tax calculation so exemption requires both a flag and a currently-valid certificate.