feat: timeline multi-select, demand popover, resource hover card, merged tooltips, dark mode fixes

Major timeline enhancements:
- Right-click drag multi-selection with floating action bar (batch delete/assign)
- DemandPopover for demand strip details (replaces broken "Loading" modal)
- ResourceHoverCard on name hover showing skills, rates, role, chapter
- Merged heatmap+vacation tooltips into unified TimelineTooltip component
- Fixed overbooking blink animation (date normalization, z-index ordering)
- Fixed dark mode sticky column bleed-through in project view
- System roles admin page, notification task management, performance review docs

Co-Authored-By: claude-flow <ruv@ruv.net>

apps/web/src/app/api/trpc/[trpc]/route.ts

@@ -1,10 +1,25 @@
-import { createTRPCContext } from "@planarchy/api";
+import { createTRPCContext, loadRoleDefaults } from "@planarchy/api";
 import { appRouter } from "@planarchy/api/router";
 import { prisma } from "@planarchy/db";
 import { fetchRequestHandler } from "@trpc/server/adapters/fetch";
 import type { NextRequest } from "next/server";
 import { auth } from "~/server/auth.js";
 
+// Throttle lastActiveAt updates: max once per 60s per user
+const lastActiveCache = new Map<string, number>();
+const ACTIVITY_THROTTLE_MS = 60_000;
+
+function trackActivity(userId: string) {
+  const now = Date.now();
+  const last = lastActiveCache.get(userId) ?? 0;
+  if (now - last < ACTIVITY_THROTTLE_MS) return;
+  lastActiveCache.set(userId, now);
+  prisma.user.update({
+    where: { id: userId },
+    data: { lastActiveAt: new Date(now) },
+  }).catch(() => {/* ignore */});
+}
+
 const handler = async (req: NextRequest) => {
   const session = await auth();
 
@@ -15,12 +30,18 @@ const handler = async (req: NextRequest) => {
       })
     : null;
 
+  // Track user activity (throttled, fire-and-forget)
+  if (dbUser) trackActivity(dbUser.id);
+
+  // Load configurable role defaults (cached, 60s TTL)
+  const roleDefaults = await loadRoleDefaults();
+
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const options: any = {
     endpoint: "/api/trpc",
     req,
     router: appRouter,
-    createContext: () => createTRPCContext({ session, dbUser }),
+    createContext: () => createTRPCContext({ session, dbUser, roleDefaults }),
   };
 
   if (process.env["NODE_ENV"] === "development") {