Harden demo access and restore clean checks

src/server/api/routers/time-entries.ts

@@ -6,6 +6,7 @@ import { TRPCError } from "@trpc/server";
 import type { db } from "~/server/db";
 import {
   computeTrackedHours,
+  normalizeOptionalId,
   resolveBillingDescription,
   type ClockOutOutcome,
 } from "~/lib/time-clock";
@@ -242,7 +243,7 @@ export const timeEntriesRouter = createTRPCRouter({
         });
       }
 
-      const clientId = input.clientId?.trim() || null;
+      const clientId = normalizeOptionalId(input.clientId);
       let clientRecord: { defaultHourlyRate: number | null } | null = null;
       if (clientId) {
         const found = await ctx.db.query.clients.findFirst({
@@ -514,7 +515,7 @@ export const timeEntriesRouter = createTRPCRouter({
   create: protectedProcedure
     .input(createSchema)
     .mutation(async ({ ctx, input }) => {
-      const clientId = input.clientId?.trim() || null;
+      const clientId = normalizeOptionalId(input.clientId);
       if (clientId) {
         const client = await ctx.db.query.clients.findFirst({
           where: and(eq(clients.id, clientId), eq(clients.createdById, ctx.session.user.id)),