feat(payroll): canonical consolidated payroll PR (supersedes #12 #15 #16)

[rmak78]

Summary

This is the canonical consolidated payroll PR built from latest main, superseding overlapping payroll PRs:

• Supersedes feat(payroll): add payroll v1 skeleton (track C) #12
• Supersedes feat(payroll): execution baseline (run lines, preview, status transitions) #15
• Supersedes feat: payroll run approval workflow, totals endpoint, and audit log #16

What’s included

• Clean migration numbering beyond merged history (avoids 0007/0008 collisions):
  • 0012_payroll_v1_skeleton.sql (pay cycles, pay components, payroll runs)
  • 0013_payroll_execution_baseline.sql (payroll run lines)
  • 0014_payroll_approval_workflow.sql (run approval/processed metadata + payroll audit logs)
• Payroll API scope in src/index.ts:
  • GET/POST /v1/pay-cycles
  • GET/POST /v1/pay-components
  • GET/POST /v1/payroll-runs
  • GET/POST /v1/payroll-run-lines
  • POST /v1/payroll-runs/calculate-preview
  • POST /v1/payroll-runs/approve
  • POST /v1/payroll-runs/mark-processed
  • GET /v1/payroll-runs/totals?payroll_run_id=<id>
  • GET/POST /v1/payroll-run-audit-logs
• Updated /v1 route catalog, write-protected path list, and module metadata (hris)
• README already reflects the canonical payroll endpoint and migration set

Validation

• npx wrangler deploy --dry-run ✅

Notes

• Please close feat(payroll): add payroll v1 skeleton (track C) #12, feat(payroll): execution baseline (run lines, preview, status transitions) #15, and feat: payroll run approval workflow, totals endpoint, and audit log #16 in favor of this PR once reviewed.
• No merge performed.