Sync time entries with invoice lines and harden auth for mobile.

Link clocked time to invoice items with bidirectional sync, add entry editing on web, broaden session cookie detection for Expo clients, and handle API rate limits without signing users out.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/api/receipts/[id]/route.ts

@@ -1,4 +1,4 @@
-import { NextRequest, NextResponse } from "next/server";
+import { type NextRequest, NextResponse } from "next/server";
 import { eq } from "drizzle-orm";
 import { getOptionalServerSession } from "~/lib/auth-server";
 import { getObject } from "~/lib/object-storage";
@@ -20,7 +20,7 @@ export async function GET(
     with: { expense: true },
   });
 
-  if (!receipt || receipt.expense.createdById !== session.user.id) {
+  if (receipt?.expense.createdById !== session.user.id) {
     return NextResponse.json({ error: "Not found" }, { status: 404 });
   }