L12 Zeiterfassung: Datenmodell, Rechte und Events für die Zeitfreigabe

Migration zeiterfassung_freigabe (TimeEntry source/approvalStatus/pendingChange,
WorkSession.manual), Rechte field:record_own_time und time:approve,
PII approvedById, Events time.approval_requested/approved/rejected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/lib/events.ts

@@ -19,13 +19,17 @@ export const EVENT_TYPES = [
   "import.ready_for_review",
   "import.failed",
   "sync.failed",
+  // L12 Zeiterfassung
+  "time.approval_requested",
+  "time.approved",
+  "time.rejected",
 ] as const;
 
 export type EventType = (typeof EVENT_TYPES)[number];
 
 export type DomainEvent = {
   type: EventType;
-  entityType: "work_order" | "report" | "import_job" | "sync_operation";
+  entityType: "work_order" | "report" | "import_job" | "sync_operation" | "time_entry";
   entityId: string;
   /** Short, human-readable facts for templates (no PII beyond what the recipient may see). */
   data?: Record<string, string | number | boolean | null>;

src/server/dsgvo/pii-fields.ts

@@ -33,6 +33,7 @@ export const PII_REFERENCE_FIELDS: readonly PiiReference[] = [
   { model: "WorkSession", field: "userId" },
   { model: "TimeEntry", field: "userId" },
   { model: "TimeEntry", field: "correctedById" },
+  { model: "TimeEntry", field: "approvedById" }, // L12: approving/rejecting person
   { model: "ActivityNote", field: "authorId" },
   { model: "Document", field: "uploadedById" },
   { model: "Photo", field: "takenById" },

src/server/rbac.ts

@@ -36,6 +36,9 @@ export const PERMISSIONS = [
   // Einsatz (Mobile): Einsatz starten, Zeiten, Material, Fotos, Notizen
   "field:execute",
   "field:correct_time",
+  "field:record_own_time", // L12: eigene Zeiten nachtragen / Korrektur vorschlagen (mit Freigabe)
+  // Zeiterfassung: Nachträge/Korrekturen freigeben (Teamleiter: eigenes Team, Backoffice: alle)
+  "time:approve",
   // Berichte
   "report:read",
   "report:write",
@@ -85,6 +88,8 @@ export const ROLE_DEFS: Record<RoleKey, { name: string; permissions: readonly Pe
       "work_order:read_team",
       "field:execute",
       "field:correct_time",
+      "field:record_own_time",
+      "time:approve",
       "report:read",
       "report:write",
       "report:approve_team",
@@ -102,6 +107,7 @@ export const ROLE_DEFS: Record<RoleKey, { name: string; permissions: readonly Pe
       "team:read",
       "work_order:read_team",
       "field:execute",
+      "field:record_own_time",
       "report:read",
       "report:write",
       "emergency:create",