v1.6.5: fix attendance unique constraint, schema sync, seed script

- Change attendance idx_attendance_user_date from unique to index (allow multiple shifts per day)
- Reset migrations to single baseline init migration
- Add seed script with admin user (admin/admin)
- Update CLAUDE.md with migration workflow documentation
- Various frontend fixes (queries, pages, hooks)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/admin/totp.ts

@@ -193,7 +193,7 @@ export default async function totpRoutes(
   // GET - check if 2FA is required company-wide
   fastify.get(
     "/required",
-    { preHandler: [requireAuth, requirePermission("settings.manage")] },
+    { preHandler: requireAuth },
     async (request, reply) => {
       const settings = await prisma.company_settings.findFirst({
         select: { require_2fa: true },
@@ -207,7 +207,7 @@ export default async function totpRoutes(
   fastify.post(
     "/required",
     {
-      preHandler: [requireAuth, requirePermission("settings.manage")],
+      preHandler: [requireAuth, requirePermission("settings.company")],
       bodyLimit: 10240,
     },
     async (request, reply) => {