feat(hr): show attendance lateness to the owner only

[bladehell-ai]

Builds on qa_fe_ui (1c0ae90f). Targets qa_fe_ui so the rest of that branch's work merges to develop together, on your schedule.

Why

b5092e30 removed the Late column and the Late Days tile outright — for everyone, including the roles that actually need the signal. This puts both back behind a role check instead, so the owner keeps them and nobody else sees lateness.

What changed

Surface	on qa_fe_ui	here
Late table column	gone for everyone	owner only
Late Days stat tile	gone for everyone	owner only
Late badge on the Status cell (Late 15m)	⚠️ still visible to everyone	owner only

That third row is the gap worth flagging: the badge renders one cell to the left of the column that was removed, so employees could still read their lateness off the Status cell. All three surfaces now ride one flag — canSeeLate = user.role === 'owner' — because hiding any one alone leaks the same number from the others.

Layout follow-ups

• The stat strip's column count follows the tile count (lg:grid-cols-5 → lg:grid-cols-4) so the grid doesn't leave a hole, and the skeleton count matches so it doesn't reflow on load.
• 1c0ae90f's w-[40%] on Status exists only to absorb the space the Late column would occupy, so it now applies only when that column is absent. The owner gets the original balanced table back.
• Restores the Clock and formatMinutes imports, and puts the Tooltip imports back to use — the removal left them imported but unused, raising three no-unused-vars warnings.

One decision worth a look

Deliberately a role check, not the attendance.view_all permission — that permission is held by org_manager, hr_manager and finance_manager alike, none of whom should see this. Trade-off: the gate is hardcoded to the owner role name. If it should be configurable per org, the clean version is a new attendance.view_late permission granted to owner only in PermissionSeeder.

Not touched

/hr/attendance/team, /hr/attendance/report, and the check-in CSV export (Late (min) column) all carry their own Late columns. Those are manager-facing, but org_manager and hr_manager can reach them — say the word if they're in scope.

Note: the branch name still says owner-hr-only from the first revision; e855befb narrowed the gate to the owner alone.

Verification

• tsc --noEmit — no errors in the changed file (the only tree-wide errors are pre-existing @tiptap/* module-resolution failures in rich-text-editor.tsx, from a stale linked node_modules).
• eslint on the changed file — 2 problems, down from 5 on the qa_fe_ui baseline (the 3 unused Tooltip warnings are cleared; the zodResolver as any cast and the react-hook-form watch() compiler warning are pre-existing).
• Not exercised in a browser — confirming both role paths needs the Docker stack plus two logins.

Supersedes #75, which targeted develop and predated this branch.

🤖 Generated with Claude Code