Sync time entries with invoice lines and harden auth for mobile.

Link clocked time to invoice items with bidirectional sync, add entry editing on web, broaden session cookie detection for Expo clients, and handle API rate limits without signing users out.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/lib/auth-server.ts

@@ -3,7 +3,11 @@ import { auth } from "~/lib/auth";
 
 export function hasSessionCookie(headers: Headers): boolean {
   const cookie = headers.get("cookie") ?? "";
+  if (!cookie.trim()) return false;
+
   return (
+    cookie.includes("session_token=") ||
+    cookie.includes("session_data=") ||
     cookie.includes("better-auth.session_token=") ||
     cookie.includes("__Secure-better-auth.session_token=")
   );