feat: timeline multi-select, demand popover, resource hover card, merged tooltips, dark mode fixes

Major timeline enhancements:
- Right-click drag multi-selection with floating action bar (batch delete/assign)
- DemandPopover for demand strip details (replaces broken "Loading" modal)
- ResourceHoverCard on name hover showing skills, rates, role, chapter
- Merged heatmap+vacation tooltips into unified TimelineTooltip component
- Fixed overbooking blink animation (date normalization, z-index ordering)
- Fixed dark mode sticky column bleed-through in project view
- System roles admin page, notification task management, performance review docs

Co-Authored-By: claude-flow <ruv@ruv.net>

packages/db/prisma/schema.prisma

@@ -177,6 +177,8 @@ model User {
   dashboardLayout    Json?     @db.JsonB
   columnPreferences  Json?     @db.JsonB
   favoriteProjectIds Json?     @db.JsonB  // string[] of project IDs
+  lastLoginAt        DateTime?
+  lastActiveAt       DateTime?
 
   accounts          Account[]
   sessions          Session[]
@@ -1359,6 +1361,8 @@ model Notification {
   @@index([userId, category, taskStatus])
   @@index([nextRemindAt])
   @@index([assigneeId, taskStatus])
+  @@index([category, nextRemindAt])
+  @@index([userId, dueDate])
   @@map("notifications")
 }
 
@@ -1390,6 +1394,22 @@ model NotificationBroadcast {
   @@map("notification_broadcasts")
 }
 
+// ─── System Role Configuration ────────────────────────────────────────────────
+
+model SystemRoleConfig {
+  role              SystemRole @id
+  label             String     // Display label, e.g. "Manager"
+  description       String?    // Optional description of the role
+  defaultPermissions Json      @db.JsonB  // PermissionKey[] — default permissions for this role
+  color             String?    // Badge color, e.g. "purple", "blue"
+  sortOrder         Int        @default(0)
+
+  createdAt         DateTime   @default(now())
+  updatedAt         DateTime   @updatedAt
+
+  @@map("system_role_configs")
+}
+
 // ─── System Settings ──────────────────────────────────────────────────────────
 
 model SystemSettings {
@@ -1419,6 +1439,8 @@ model SystemSettings {
   anonymizationAliases    Json?    @db.JsonB
   // Vacation defaults
   vacationDefaultDays     Int?     @default(28)  // default annual entitlement
+  // Timeline undo
+  timelineUndoMaxSteps    Int?     @default(50)  // max undo history depth
   // DALL-E image generation (Azure requires separate deployment)
   azureDalleDeployment    String?  // e.g. "dall-e-3" — Azure DALL-E deployment name
   azureDalleEndpoint      String?  // Optional: separate endpoint for DALL-E (if different from chat)