feat(workers): unify water + time worker tables into field_workers (cycle 10)

The two per-domain worker tables (water_irrigators, time_tracking_workers)
both carried a pin_hash, a brand, a role, and almost-identical columns.
Migrating a Tuxedo worker from one app to the other meant a duplicate
PIN. Field and admin staff complained; ops got inconsistent identity
records per domain.

Unify into a single field_workers table. Cycle 10 migration
0097_field_workers.sql:
- creates field_workers (id, brand_id, name, pin_hash, role with CHECK
  IN ('worker','time_admin','irrigator','water_admin'),
  language_preference, phone, notes, active, last_used_at, …)
- adds brand-scoped RLS, brand index, active index
- nullable field_worker_id on downstream tables, backfilled via
  UPDATE … FROM, NULL count verified with RAISE EXCEPTION before
  SET NOT NULL
- drops the two old tables and renames FK columns
  (irrigator_id → field_worker_id, worker_id → field_worker_id)
- reissues the one-open-clock-in partial unique index against
  field_worker_id

Application surface:
- All actions/services now read/write fieldWorkers. Drizzle's enum
  literal infers tighter role types than the prior ad-hoc casts.
- The verify paths still filter to their respective domain roles so a
  water-only worker can't be matched against a time-tracking PIN.
- API surface preserved: action function names didn't change.
- Seed file updated so QA reseeds work post-deploy.

Verified:
- npx tsc --noEmit clean
- npx vitest: 218 pass; 29 failures are pre-existing on main
- npm run lint: exit 0 (no new violations from cycle 10)
- npm run build: exit 0
- /water and /tuxedo/time-clock both 200 on dev
- DB verified via direct query: 20 field_workers, 200 water entries
  with zero NULL field_worker_id, index rebuilt.

PR-reviewer: APPROVED.

db/seeds/2026-qa-audit-scale.sql

@@ -307,13 +307,23 @@ ON CONFLICT DO NOTHING;
 -- ============================================================================
 -- 11. Time tracking infrastructure + logs
 -- ============================================================================
-INSERT INTO time_tracking_workers (id, brand_id, name, role, pin, lang, active)
+-- Cycle 10: workers are unified into `field_workers`. We seed both the
+-- former `time_tracking_workers` (role worker|time_admin) and the former
+-- `water_irrigators` (role irrigator|water_admin) into the same table.
+INSERT INTO field_workers (id, brand_id, name, role, pin_hash, language_preference, active)
 SELECT gen_random_uuid(), b.id, 'Worker ' || i, CASE (i%2) WHEN 0 THEN 'worker' ELSE 'time_admin' END, lpad((1000+i)::text, 4, '0'), 'en', true
 FROM brands b
 CROSS JOIN generate_series(1, 5) AS i
 WHERE b.id IN ('11111111-1111-1111-1111-111111111111','22222222-2222-2222-2222-222222222222')
 ON CONFLICT DO NOTHING;
 
+INSERT INTO field_workers (id, brand_id, name, role, pin_hash, language_preference, phone, active)
+SELECT gen_random_uuid(), b.id, 'Irrigator ' || i, 'irrigator', 'placeholder-pin-hash', 'en', '+15550100000', true
+FROM brands b
+CROSS JOIN generate_series(1, 5) AS i
+WHERE b.id IN ('11111111-1111-1111-1111-111111111111','22222222-2222-2222-2222-222222222222')
+ON CONFLICT DO NOTHING;
+
 INSERT INTO time_tracking_tasks (id, brand_id, name, unit, sort_order, active)
 SELECT gen_random_uuid(), b.id, 'Task ' || i, CASE (i%3) WHEN 0 THEN 'hours' WHEN 1 THEN 'pieces' ELSE 'units' END, i, true
 FROM brands b
@@ -321,10 +331,10 @@ CROSS JOIN generate_series(1, 8) AS i
 WHERE b.id IN ('11111111-1111-1111-1111-111111111111','22222222-2222-2222-2222-222222222222')
 ON CONFLICT DO NOTHING;
 
-INSERT INTO time_tracking_logs (brand_id, worker_id, task_id, task_name, clock_in, clock_out, lunch_break_minutes, notes)
+INSERT INTO time_tracking_logs (brand_id, field_worker_id, task_id, task_name, clock_in, clock_out, lunch_break_minutes, notes)
 SELECT
   b.id,
-  (SELECT id FROM time_tracking_workers WHERE brand_id = b.id ORDER BY random() LIMIT 1),
+  (SELECT id FROM field_workers WHERE brand_id = b.id AND role IN ('worker','time_admin') ORDER BY random() LIMIT 1),
   (SELECT id FROM time_tracking_tasks WHERE brand_id = b.id ORDER BY random() LIMIT 1),
   'Task ' || (1 + (i % 8)),
   (NOW() - ((i % 30) || ' days')::interval - ((i % 8) || ' hours')::interval),
@@ -346,18 +356,11 @@ CROSS JOIN generate_series(1, 5) AS i
 WHERE b.id IN ('11111111-1111-1111-1111-111111111111','22222222-2222-2222-2222-222222222222')
 ON CONFLICT DO NOTHING;
 
-INSERT INTO water_irrigators (id, brand_id, name, pin_hash, language_preference, role, phone, active)
-SELECT gen_random_uuid(), b.id, 'Irrigator ' || i, 'placeholder-pin-hash', 'en', 'irrigator', '+15550100000', true
-FROM brands b
-CROSS JOIN generate_series(1, 5) AS i
-WHERE b.id IN ('11111111-1111-1111-1111-111111111111','22222222-2222-2222-2222-222222222222')
-ON CONFLICT DO NOTHING;
-
-INSERT INTO water_log_entries (brand_id, headgate_id, irrigator_id, measurement, unit, logged_at, logged_by, method, total_gallons, notes)
+INSERT INTO water_log_entries (brand_id, headgate_id, field_worker_id, measurement, unit, logged_at, logged_by, method, total_gallons, notes)
 SELECT
   b.id,
   (SELECT id FROM water_headgates WHERE brand_id = b.id ORDER BY random() LIMIT 1),
-  (SELECT id FROM water_irrigators WHERE brand_id = b.id ORDER BY random() LIMIT 1),
+  (SELECT id FROM field_workers WHERE brand_id = b.id AND role IN ('irrigator','water_admin') ORDER BY random() LIMIT 1),
   (50 + (i * 7) % 200)::numeric,
   'GPM',
   NOW() - ((i % 14) || ' days')::interval,