security: add future date guard to entry validation

- Zod refine rejects dates beyond today in createEntrySchema
- Per-day 24h hour cap already in entries.js (prev commit)
- totalHours populated in history endpoint (prev commit)
- Removed duplicate security headers from nginx (Caddy handles)

backend/src/utils/validation.js

@@ -26,8 +26,11 @@ const refreshSchema = z.object({
 const createEntrySchema = z.object({
   date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/, 'Date must be YYYY-MM-DD')
     .refine(val => {
-      const entryDate = new Date(val + 'T23:59:59Z');
-      return entryDate <= new Date();
+      // Allow today + past dates. Compare date-only (ignore time).
+      // Use T12:00 to avoid timezone edge cases.
+      const today = new Date();
+      const todayStr = today.toISOString().split('T')[0];
+      return val <= todayStr;
     }, { message: 'Cannot create entries for future dates' }),
   homeownerId: z.string().uuid('Invalid homeowner ID'),
   hoursWorked: z