feat: time clock links to latest client invoice + fix SSO verification token overflow

- Clock out and manual entry creation now auto-add a line item to the
  client's latest draft/sent invoice and return invoice info
- Time clock page shows invoice badge on each entry with a link
- Toast after clock-out/create includes "View Invoice" action when linked
- MCP time_clock_in now accepts optional startedAt for backdating
- MCP time_clock_out description updated to document invoice linking
- Migration 0012: widen beenvoice_verification_token.value to text to
  fix varchar(255) overflow during Authentik PKCE OAuth flow

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

drizzle/0012_verification_token_value_text.sql

@@ -0,0 +1 @@
+ALTER TABLE "beenvoice_verification_token" ALTER COLUMN "value" TYPE text;

drizzle/meta/_journal.json

@@ -85,6 +85,13 @@
       "when": 1749254400000,
       "tag": "0011_time_entry_invoice_id",
       "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "7",
+      "when": 1749340800000,
+      "tag": "0012_verification_token_value_text",
+      "breakpoints": true
     }
   ]
 }