v1.6.5: fix attendance unique constraint, schema sync, seed script

- Change attendance idx_attendance_user_date from unique to index (allow multiple shifts per day)
- Reset migrations to single baseline init migration
- Add seed script with admin user (admin/admin)
- Update CLAUDE.md with migration workflow documentation
- Various frontend fixes (queries, pages, hooks)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/admin/roles.ts

@@ -12,7 +12,7 @@ export default async function rolesRoutes(
   // GET /api/admin/roles
   fastify.get(
     "/",
-    { preHandler: requirePermission("settings.manage") },
+    { preHandler: requirePermission("settings.roles") },
     async (request, reply) => {
       const roles = await prisma.roles.findMany({
         include: {
@@ -35,7 +35,7 @@ export default async function rolesRoutes(
   // GET /api/admin/roles/permissions
   fastify.get(
     "/permissions",
-    { preHandler: requirePermission("settings.manage") },
+    { preHandler: requirePermission("settings.roles") },
     async (_request, reply) => {
       const permissions = await prisma.permissions.findMany({
         orderBy: { module: "asc" },
@@ -47,7 +47,7 @@ export default async function rolesRoutes(
   // POST /api/admin/roles
   fastify.post(
     "/",
-    { preHandler: requirePermission("settings.manage") },
+    { preHandler: requirePermission("settings.roles") },
     async (request, reply) => {
       const parsed = parseBody(CreateRoleSchema, request.body);
       if ("error" in parsed) return error(reply, parsed.error, 400);
@@ -90,7 +90,7 @@ export default async function rolesRoutes(
   // PUT /api/admin/roles/:id
   fastify.put<{ Params: { id: string } }>(
     "/:id",
-    { preHandler: requirePermission("settings.manage") },
+    { preHandler: requirePermission("settings.roles") },
     async (request, reply) => {
       const id = parseId(request.params.id, reply);
       if (id === null) return;
@@ -142,7 +142,7 @@ export default async function rolesRoutes(
   // DELETE /api/admin/roles/:id
   fastify.delete<{ Params: { id: string } }>(
     "/:id",
-    { preHandler: requirePermission("settings.manage") },
+    { preHandler: requirePermission("settings.roles") },
     async (request, reply) => {
       const id = parseId(request.params.id, reply);
       if (id === null) return;