feat(backend): add core work data APIs

[dohyeon16]

Summary

Phase 3A on top of the existing WIP scaffolding (92f8891: geo.py + owned-record mixin). Completes full CRUD for the three core work-data resources: workplaces, work_schedules, attendance_records.

Builds on Phase 2 auth (base main = 770416e) — every endpoint is authenticated and scoped to the token's user. Schema is derived from the mobile app's local storage models, not guessed.

What's in it

Models & migration — Alembic 0003_work_data (← 0002_auth_tables): 3 tables with FKs, unique(user_id, client_id), check constraints (non-negative wage/break, coordinate range + pairing), and per-resource indexes. Times stored as "HH:mm" strings, work_date as DATE, money as integer won (no float).

Ownership & security — all queries scoped to the current user; cross-user or missing IDs return 404 (no existence leak); invalid UUIDs → 422. Two-account isolation covered by tests.

client_id idempotency — unique(user_id, client_id). Re-sending the same client_id returns the existing record (200) instead of duplicating; re-creating a deleted client_id → 409 (prevents offline-sync resurrection).

Deletion policy — soft delete everywhere. Deleting a workplace does not cascade-delete its schedules/attendance (history preserved). New schedule/attendance referencing a deleted (or others') workplace → 422.

Dates & times — work_date is a real DATE (no UTC conversion); created_at/updated_at are timezone-aware UTC. Midnight-crossing shifts supported (end < start ⇒ next day), no separate end-date column, matching the mobile calc rule.

GPS — clock_in_proximity/clock_out_proximity in responses are recomputed server-side from workplace coords via core/geo (client-sent distance is never accepted). Minimal fix to geo.proximity so the radius check uses the raw (un-rounded) distance — matches mobile evaluateProximity.

Lists — limit/offset pagination (default 50, max 200), workplace_id/date_from/date_to filters, deterministic ordering, internal fields (user_id, deleted_at) hidden.

Tests

• 45 new tests across workplaces / work_schedules / attendance_records + migration round-trip. Full suite: 100 passed, 2 skipped (PG-only).
• Phase 2 auth regression: unchanged — all original auth/user/token/migration tests still pass.
• Alembic verified: single head 0003_work_data, offline PG SQL for all 3 tables, and a real SQLite upgrade→downgrade→upgrade round-trip proving auth tables survive the downgrade.

Preview live verification (2026-08-05)

Verified against the live Preview deployment of 2820922 (service workproof-backend-preview, connected branch main, Neon Preview DB shy-thunder-48215343). Production was not touched.

• Migration: Preview DB advanced 0002_auth_tables → 0003_work_data; revision confirmed on the DB. Applied once (not re-run).
• Result: 55 / 55 checks PASSED against real PostgreSQL — no 5xx, no HTML tracebacks, no secrets in output.

Coverage exercised end-to-end over HTTP:

• Health — /health, /api/v1/health, /api/v1/health/db (database: connected) all 200.
• Auth regression — register / login / users/me / refresh rotation + refresh-reuse detection (old token → 401); unauthenticated request → 401.
• CRUD — workplaces, work-schedules, attendance-records (all 15 endpoints).
• Ownership isolation — a second user's GET/PATCH/DELETE on another user's resources → 404; list excludes them.
• client_id idempotency — replay → 200 with same id; reuse of a soft-deleted client_id → 409.
• Soft delete — deleted resources excluded from both list and single GET (404).
• Deleted-workplace references — new schedule/attendance against a deleted workplace → 422.
• Filters / paging / ordering — date_from/date_to, workplace_id, limit/offset (disjoint pages), deterministic ordering, inverted range → 422.
• GPS (server-side Haversine) — 150 m & 199 m → verified: true; 201 m & 250 m → verified: false; missing workplace or record coords → proximity: null. Display distances match half-up rounding (150/199/201/250 m).

Temp accounts and all verification work-data were cleaned up through the API (both accounts deleted; work-data soft-deleted) — 0 active temp rows remain in the Preview DB. This PR stays Draft; not merged, not wired to mobile.

Scope / not included

• Not wired to the mobile app yet.
• Deferred to later phases: payroll (PayRecord) & the workplace wage-policy fields (payDay/weeklyAllowance/etc.), contracts/evidence/OCR, provider social-token verification.
• No changes to PR feat: expand payroll, attendance, scheduling, and security features #1 / refactor: organize mobile source by feature #3 / feat(mobile): integrate backend authentication #7 or Issue test: complete native validation for major enhancements #2.

Notes

• First commit 92f8891 (WIP scaffolding) is preserved; this PR adds 2820922 on top.
• Draft — not ready to merge.

🤖 Generated with Claude Code