feat: timeline multi-select, demand popover, resource hover card, merged tooltips, dark mode fixes

Major timeline enhancements:
- Right-click drag multi-selection with floating action bar (batch delete/assign)
- DemandPopover for demand strip details (replaces broken "Loading" modal)
- ResourceHoverCard on name hover showing skills, rates, role, chapter
- Merged heatmap+vacation tooltips into unified TimelineTooltip component
- Fixed overbooking blink animation (date normalization, z-index ordering)
- Fixed dark mode sticky column bleed-through in project view
- System roles admin page, notification task management, performance review docs

Co-Authored-By: claude-flow <ruv@ruv.net>

packages/api/src/router/system-role-config.ts

@@ -0,0 +1,40 @@
+import { z } from "zod";
+import { adminProcedure, createTRPCRouter, invalidateRoleDefaultsCache, protectedProcedure } from "../trpc.js";
+
+export const systemRoleConfigRouter = createTRPCRouter({
+  /** List all role configs (sorted by sortOrder) */
+  list: protectedProcedure.query(async ({ ctx }) => {
+    return ctx.db.systemRoleConfig.findMany({
+      orderBy: { sortOrder: "asc" },
+    });
+  }),
+
+  /** Update a role's default permissions, label, description, and color */
+  update: adminProcedure
+    .input(
+      z.object({
+        role: z.string(),
+        label: z.string().min(1).optional(),
+        description: z.string().nullable().optional(),
+        color: z.string().nullable().optional(),
+        defaultPermissions: z.array(z.string()).optional(),
+      }),
+    )
+    .mutation(async ({ ctx, input }) => {
+      const data: Record<string, unknown> = {};
+      if (input.label !== undefined) data.label = input.label;
+      if (input.description !== undefined) data.description = input.description;
+      if (input.color !== undefined) data.color = input.color;
+      if (input.defaultPermissions !== undefined) data.defaultPermissions = input.defaultPermissions;
+
+      const result = await ctx.db.systemRoleConfig.update({
+        where: { role: input.role as never },
+        data,
+      });
+
+      // Invalidate cached role defaults so changes take effect immediately
+      invalidateRoleDefaultsCache();
+
+      return result;
+    }),
+});