fix: make clients shared across all users instead of per-user scoped

[devin-ai-integration]

Summary

Removes user_email filtering from all client-related SQL queries so that clients are shared across all authenticated employees rather than siloed per-user. Previously, a client created by User A was invisible to User B because every client query included WHERE user_email = ?.

Files changed:

• backend/src/routes/clients.js — Removed user_email from all client CRUD queries (list, get, update, delete, delete-all).
• backend/src/routes/workEntries.js — Removed user_email from client-existence checks when creating/updating work entries. Error message simplified from "Client not found or does not belong to user" → "Client not found".
• backend/src/routes/reports.js — Removed user_email from client lookups and work-entry queries in report/export endpoints.
• Test files updated to match new query parameters and error messages.

Note: work entry CRUD (GET /work-entries, PUT, DELETE) still filters by user_email — each user manages their own time entries, but against a shared pool of clients.

Review & Testing Checklist for Human

• DELETE /api/clients is now a global delete — it previously deleted only the authenticated user's clients; it now deletes all clients for every user. Verify this is acceptable or if it should be removed/restricted to an admin role.
• Reports now aggregate work entries across all users for a given client — the user_email filter was removed from work-entry queries in reports.js. Confirm this is the desired behavior (cross-user report) vs. only showing the current user's hours for a shared client.
• Any authenticated user can edit/delete any client — there is no ownership or role check. Confirm this matches the "all employees share all clients" requirement.
• Manual E2E test: Log in as User A → create a client → log out → log in as User B → verify the client is visible and editable. Then verify deleting a single client and the "Clear All" button behave as expected.

Notes

• Client creation still stores user_email in the clients table (as the creator), which could be useful for audit purposes in the future.
• A bug reproduction recording and a fix verification recording were captured during development.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/610609f36a08438580ad0478c21a7f68

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[sonarqubecloud]

Quality Gate failed

Failed conditions
42.6% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud