feat: time clock links to latest client invoice + fix SSO verification token overflow

- Clock out and manual entry creation now auto-add a line item to the
  client's latest draft/sent invoice and return invoice info
- Time clock page shows invoice badge on each entry with a link
- Toast after clock-out/create includes "View Invoice" action when linked
- MCP time_clock_in now accepts optional startedAt for backdating
- MCP time_clock_out description updated to document invoice linking
- Migration 0012: widen beenvoice_verification_token.value to text to
  fix varchar(255) overflow during Authentik PKCE OAuth flow

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/server/api/routers/time-entries.ts

@@ -133,6 +133,7 @@ export const timeEntriesRouter = createTRPCRouter({
         description: z.string().max(500).default(""),
         clientId: z.string().optional().or(z.literal("")),
         rate: z.number().min(0).optional(),
+        startedAt: z.date().optional(),
       }),
     )
     .mutation(async ({ ctx, input }) => {
@@ -157,12 +158,17 @@ export const timeEntriesRouter = createTRPCRouter({
         if (!client) throw new TRPCError({ code: "FORBIDDEN", message: "Client not found" });
       }
 
+      const startedAt = input.startedAt ?? new Date();
+      if (startedAt > new Date()) {
+        throw new TRPCError({ code: "BAD_REQUEST", message: "startedAt cannot be in the future" });
+      }
+
       const [entry] = await ctx.db
         .insert(timeEntries)
         .values({
           description: input.description,
           clientId,
-          startedAt: new Date(),
+          startedAt,
           rate: input.rate ?? null,
           createdById: ctx.session.user.id,
         })