fix: harden sessions and domain validation

app/Domain/Jobcard/TimeAggregator.php

@@ -22,7 +22,7 @@ final class TimeAggregator
     {
         return $this->total(array_values(array_filter(
             $entries,
-            static fn ($entry): bool => is_array($entry) && (($entry['counts_toward_sla'] ?? true) === true)
+            static fn ($entry): bool => is_array($entry) && in_array($entry['counts_toward_sla'] ?? true, [true, 1, '1'], true)
         )));
     }
 }

app/Domain/Jobcard/TimeCalculator.php

@@ -4,7 +4,7 @@ declare(strict_types=1);
 function calculate_duration_hours(?string $start, ?string $end, ?float $manualHours = null): ?float
 {
     if ($manualHours !== null) {
-        return $manualHours >= 0 ? round($manualHours, 2) : null;
+        return $manualHours > 0 ? round($manualHours, 2) : null;
     }
     if ($start === null || $end === null || !preg_match('/^\d{2}:\d{2}$/', $start) || !preg_match('/^\d{2}:\d{2}$/', $end)) {
         return null;