Sync time entries with invoice lines and harden auth for mobile.

Link clocked time to invoice items with bidirectional sync, add entry editing on web, broaden session cookie detection for Expo clients, and handle API rate limits without signing users out.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/server/db/schema.ts

@@ -432,6 +432,9 @@ export const invoiceItems = createTable(
     rate: d.real().notNull(),
     amount: d.real().notNull(),
     position: d.integer().notNull().default(0), // NEW: position for ordering
+    timeEntryId: d
+      .varchar({ length: 255 })
+      .references(() => timeEntries.id, { onDelete: "set null" }),
     createdAt: d
       .timestamp()
       .default(sql`CURRENT_TIMESTAMP`)
@@ -449,6 +452,10 @@ export const invoiceItemsRelations = relations(invoiceItems, ({ one }) => ({
     fields: [invoiceItems.invoiceId],
     references: [invoices.id],
   }),
+  timeEntry: one(timeEntries, {
+    fields: [invoiceItems.timeEntryId],
+    references: [timeEntries.id],
+  }),
 }));
 
 export const expenses = createTable(