fix: harden sessions and domain validation

app/Domain/Jobcard/TimeAggregator.php

@@ -22,7 +22,7 @@ final class TimeAggregator
     {
         return $this->total(array_values(array_filter(
             $entries,
-            static fn ($entry): bool => is_array($entry) && (($entry['counts_toward_sla'] ?? true) === true)
+            static fn ($entry): bool => is_array($entry) && in_array($entry['counts_toward_sla'] ?? true, [true, 1, '1'], true)
         )));
     }
 }

app/Domain/Jobcard/TimeCalculator.php

@@ -4,7 +4,7 @@ declare(strict_types=1);
 function calculate_duration_hours(?string $start, ?string $end, ?float $manualHours = null): ?float
 {
     if ($manualHours !== null) {
-        return $manualHours >= 0 ? round($manualHours, 2) : null;
+        return $manualHours > 0 ? round($manualHours, 2) : null;
     }
     if ($start === null || $end === null || !preg_match('/^\d{2}:\d{2}$/', $start) || !preg_match('/^\d{2}:\d{2}$/', $end)) {
         return null;

app/Domain/SLA/SlaCalculator.php

@@ -3,6 +3,9 @@ declare(strict_types=1);
 
 function calculate_sla_usage(float $allocatedHours, array $hours): array
 {
+    if ($allocatedHours < 0) {
+        throw new InvalidArgumentException('Allocated hours must not be negative.');
+    }
     $used = round(array_sum(array_map(static fn ($value): float => max(0.0, (float)$value), $hours)), 2);
     $remaining = round(max(0.0, $allocatedHours - $used), 2);
     $percentage = $allocatedHours > 0 ? round(($used / $allocatedHours) * 100, 2) : ($used > 0 ? 100.0 : 0.0);