L12 Zeiterfassung: Datenmodell, Rechte und Events für die Zeitfreigabe

Migration zeiterfassung_freigabe (TimeEntry source/approvalStatus/pendingChange,
WorkSession.manual), Rechte field:record_own_time und time:approve,
PII approvedById, Events time.approval_requested/approved/rejected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/server/dsgvo/pii-fields.ts

@@ -33,6 +33,7 @@ export const PII_REFERENCE_FIELDS: readonly PiiReference[] = [
   { model: "WorkSession", field: "userId" },
   { model: "TimeEntry", field: "userId" },
   { model: "TimeEntry", field: "correctedById" },
+  { model: "TimeEntry", field: "approvedById" }, // L12: approving/rejecting person
   { model: "ActivityNote", field: "authorId" },
   { model: "Document", field: "uploadedById" },
   { model: "Photo", field: "takenById" },

src/server/rbac.ts

@@ -36,6 +36,9 @@ export const PERMISSIONS = [
   // Einsatz (Mobile): Einsatz starten, Zeiten, Material, Fotos, Notizen
   "field:execute",
   "field:correct_time",
+  "field:record_own_time", // L12: eigene Zeiten nachtragen / Korrektur vorschlagen (mit Freigabe)
+  // Zeiterfassung: Nachträge/Korrekturen freigeben (Teamleiter: eigenes Team, Backoffice: alle)
+  "time:approve",
   // Berichte
   "report:read",
   "report:write",
@@ -85,6 +88,8 @@ export const ROLE_DEFS: Record<RoleKey, { name: string; permissions: readonly Pe
       "work_order:read_team",
       "field:execute",
       "field:correct_time",
+      "field:record_own_time",
+      "time:approve",
       "report:read",
       "report:write",
       "report:approve_team",
@@ -102,6 +107,7 @@ export const ROLE_DEFS: Record<RoleKey, { name: string; permissions: readonly Pe
       "team:read",
       "work_order:read_team",
       "field:execute",
+      "field:record_own_time",
       "report:read",
       "report:write",
       "emergency:create",