Overview

This PR takes over and resolves the stale payroll PR (#235).

• Merged latest main into the payroll branch
• Resolved all merge conflicts
• Fixed notification roles import preventing backend startup
• Validated payroll functionality locally

Validation

Backend starts successfully after merge

• GET /api/v1/payroll returns expected structure
• GET /api/v1/payroll/export returns CSV successfully
• OTP login flow validated (dev mode via terminal OTP)
• RBAC enforcement confirmed:
  • employer role receives 403 on approve endpoint (expected behaviour)

Notes

• Payroll generation verified using completed shift within test date range
• Admin approve/process flow not executed end-to-end due to separate admin auth path and lack of local credentials