feat: complete jobcard management workflows and UI

docs/uat-checklist.md

@@ -57,6 +57,22 @@ Run this checklist against a production-like deployment over HTTPS with a fresh
 - [ ] Verify CSV/other exports handle commas, quotes, line breaks and formula-like values safely.
 - [ ] Compare a report total with the underlying test jobcards/time entries and retain the comparison evidence.
 
+## Final-scope acceptance cases
+
+Use distinct fixture IDs for each client and record expected/observed results without including secrets in evidence. The executable contract companion is `php -d assert.exception=1 tests/FinalScopeIntegrationTest.php`.
+
+- [ ] **FS-01 — Technical information:** Add valid hosting/VPN/domain/database/SSH/API metadata; verify labels and usernames are trimmed, supported categories are enforced, control characters/oversized notes are rejected, and display output contains metadata only (never a credential secret).
+- [ ] **FS-02 — Contact actions:** Edit a contact, promote a secondary contact, and delete a primary contact; verify duplicate names/emails are rejected, only same-client primary contacts are demoted, the lowest remaining same-client contact is promoted on primary deletion, and a client's sole contact cannot be deleted.
+- [ ] **FS-03 — Time corrections:** Correct date, duration, notes and SLA-counting state while retaining the original time-entry ID, jobcard ID and technician ID. Verify ownership changes, corrections to voided entries, invalid ranges and missing void reasons are rejected. Confirm the original and correction/void actor are retained by the deployment's audit trail.
+- [ ] **FS-04 — Custom roles:** Create a custom role, assign a least-privilege permission set, rename it and remove it; verify permissions are normalized/deduplicated, server-side authorization remains enforced on direct URLs/forms, and the Administrator role cannot be renamed, deleted or permission-edited.
+- [ ] **FS-05 — Notifications:** Trigger assignment, status-change and SLA-threshold events; verify normalized per-user rows, stable deduplication, inactive/unknown recipients skipped, mark-read changes only the authenticated user's row, and notification bodies contain no credential or internal-note values.
+- [ ] **FS-06 — Report audience separation:** Compare the same fixtures in client and internal reports/print/CSV output. Client audience must omit technician identity, internal notes, credentials and other operational-only fields; internal audience may retain authorized attribution. Direct report URLs and exports must enforce the same audience and role checks.
+- [ ] **FS-07 — Technician scope:** With two technicians and two clients, verify each technician can list/view/update only assigned jobcards and sees only their own time totals. Changing jobcard, client, attachment, credential, report or time-entry IDs must return the documented not-found/denied response without leaking metadata or mutating another technician's records.
+- [ ] **FS-08 — CSRF and method checks:** Submit missing and wrong CSRF tokens to login, logout, client/contact, jobcard/status/assignment/time, attachment, credential, SLA, notification and custom-role state changes; every request must be rejected before mutation (HTTP 419 or documented equivalent). Verify GET requests are read-only and logout is POST-only.
+- [ ] **FS-09 — Attachment boundary:** Attempt traversal names, executable/double extensions, MIME/signature mismatches, oversized files and client-visible files without explicit approval; each must be rejected before storage. Upload a valid image/PDF and verify a generated server filename, validated MIME, `X-Content-Type-Options: nosniff`, no executable download behavior, and cross-client/jobcard access denial.
+- [ ] **FS-10 — Credential boundary:** Create a canary credential and verify the database stores only `secret_ciphertext`, normal views show a mask, reveal is permission-controlled, client-bound, audited and returned with `Cache-Control: no-store`; a different client/credential ID cannot reveal it. Do not put the canary in screenshots, tickets or UAT evidence.
+- [ ] **FS-11 — Production healthcheck:** Run `php bin/healthcheck.php` with valid configuration and capture exit status plus status-only output. Verify all current schema tables are probed, no password/APP_KEY/DSN/SQL exception/path is printed, and a disposable database missing one required table produces a non-zero exit. Run the same check after restore.
+
 ## Restore verification
 
 - [ ] Restore the pre-UAT backup to a separate database/server, never over the live database.