Coastal Timesheet v2 — full feature buildout

Features:
- Copy Previous Week (entries duplication)
- Bulk Approve/Reject (admin workflow)
- Overtime tracking (employee + admin views)
- DayCard component with auto-save
- PDF generation, email notifications
- React + Tailwind frontend, Prisma + PostgreSQL backend
- Docker deployment (3 containers)

CHANGELOG.md

@@ -0,0 +1,63 @@
+# Changelog
+
+All notable changes to Coastal Timesheet will be documented in this file.
+
+## [2.1.0] - 2026-02-15
+
+### Added
+
+- **Copy Previous Week** — One-tap button to duplicate last week's entries into the current week. Shifts dates automatically, skips deactivated homeowners. Shows on empty weeks only.
+- **Bulk Approve / Reject** — Admin Reviews tab now supports multi-select with "Select All" checkbox and bulk action buttons. Process 40+ timesheets in one click instead of one-by-one.
+- **Overtime Tracking** — New admin "Overtime" tab with per-employee weekly breakdown, total/regular/OT summary cards, and date range filtering. Employee timesheet page shows real-time amber warning banner when hours exceed 40h/week (FLSA threshold).
+- **Homeowner Filter on Reports** — Admin Reports tab now includes a homeowner dropdown filter to see all time logged at a specific property.
+- **Homeowner Address Field** — Homeowners now have a separate address field. House numbers split from names into dedicated address column.
+- **Homeowner Edit/Search** — Full inline editing for homeowner name and address, search bar, toggle active/inactive with "Show inactive" filter.
+- **Employee Edit/Delete** — Admin Users tab now has role dropdown (employee/admin), deactivate button (soft-delete preserving history), and reactivate option.
+- **Reopen Timesheet** — `PUT /api/admin/timesheets/:id/reopen` endpoint allows admins to unlock approved/rejected timesheets for corrections.
+- **Timesheet History** — `GET /api/timesheets/history` endpoint returns all user timesheets for the History page.
+- **Public Homeowners API** — `GET /api/homeowners` endpoint for authenticated users (used by timesheet entry form).
+
+### Fixed
+
+- **Timezone bug** — `new Date("YYYY-MM-DD")` parsed as UTC, causing wrong day names in US timezones. All date parsing now uses local time.
+- **CORS policy violation** — Added Tailscale IP to allowed CORS origins.
+- **Approve button 400 error** — Frontend now sends `{}` body on approve (validation required an object).
+- **PDF download silent failure** — Frontend was using `timesheet.id` but API returns `timesheetId`. Fixed field mapping.
+- **Auto-save errors on incomplete entries** — Auto-save now only fires when all required fields (homeowner, hours, description) are filled. Incomplete entries show amber border indicator.
+- **History page crash** — `.map is not a function` when API returned object instead of array. Added dedicated history endpoint.
+- **Rate limit too aggressive** — Auth endpoint bumped from 5 to 50 attempts per 15 min for development.
+
+### API Endpoints Added
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| POST | `/api/entries/copy-week` | Copy entries from one week to another |
+| POST | `/api/admin/timesheets/bulk-approve` | Approve multiple timesheets |
+| POST | `/api/admin/timesheets/bulk-reject` | Reject multiple timesheets |
+| GET | `/api/admin/overtime` | Overtime report with filters |
+| GET | `/api/timesheets/overtime` | Employee's own overtime for a week |
+| PUT | `/api/admin/timesheets/:id/reopen` | Reopen locked timesheet |
+| DELETE | `/api/admin/users/:id` | Deactivate employee (soft-delete) |
+| GET | `/api/timesheets/history` | All user timesheets |
+| GET | `/api/homeowners` | Public homeowner list |
+
+## [2.0.0] - 2026-02-15
+
+### Added
+
+- Complete rewrite from static HTML to production-grade stack
+- React 18 + Vite + Tailwind CSS (mobile-first design)
+- Express + Prisma + PostgreSQL backend
+- JWT authentication with role-based access (employee, admin, super_admin)
+- Weekly Mon–Sun timesheets with auto-save (800ms debounce)
+- Multiple homeowner entries per day
+- Submit → Approve/Reject workflow
+- Server-side PDF generation (@react-pdf/renderer)
+- SMTP email integration with branded HTML templates
+- Admin panel with employee/homeowner management
+- Reporting with employee, status, and date range filters
+- Dark mode (system-aware + manual toggle)
+- Docker Compose single-command deployment
+- Non-root containers, Helmet security headers, bcrypt, Zod validation
+- Rate limiting on auth endpoints
+- 46 homeowners seeded from v1 data