feat: time clock links to latest client invoice + fix SSO verification token overflow

- Clock out and manual entry creation now auto-add a line item to the
  client's latest draft/sent invoice and return invoice info
- Time clock page shows invoice badge on each entry with a link
- Toast after clock-out/create includes "View Invoice" action when linked
- MCP time_clock_in now accepts optional startedAt for backdating
- MCP time_clock_out description updated to document invoice linking
- Migration 0012: widen beenvoice_verification_token.value to text to
  fix varchar(255) overflow during Authentik PKCE OAuth flow

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/server/db/schema.ts

@@ -202,7 +202,7 @@ export const verificationTokens = createTable(
       .primaryKey()
       .$defaultFn(() => crypto.randomUUID()), // Matched DB: text
     identifier: d.varchar({ length: 255 }).notNull(),
-    value: d.varchar({ length: 255 }).notNull(),
+    value: d.text().notNull(),
     expiresAt: d.timestamp().notNull(),
     createdAt: d.timestamp().notNull().defaultNow(),
     updatedAt: d