[vincentmakes]

This branch carries every release from 1.12.0 to 2.0.0 (157 commits). Each one answered a concrete gap that labs running several teams on one site kept hitting; the per-release detail is in CHANGELOG.md.

Why, release by release

1.12.0 — Teams

• A site often hosts several groups that plan independently; until now everyone saw everything at the site. Teams let people narrow the Gantt, Kanban, Staff and Equipment views to their group, remembered per site.
• Tags, equipment and company events can be limited to teams, so a team-only closure no longer takes the whole site out of capacity.

1.13.0 — Roles, permissions and approvals

• Three hard-coded roles could not express real organisations. Roles are now editable permission sets (59 keys), with project-manager rights on the projects a person manages.
• Some teams want people to request their own bookings rather than make them: own bookings can need approval, decided by the PM and/or chosen roles, with a visible pending state that does not count in capacity.
• Superusers and users now see only the sites they belong to, closing a long-standing data-visibility gap.

1.14.0 — Date picker

• Typed dates and the native picker caused inverted ranges and missed holidays. One two-month calendar for every date shows weekends, bank holidays and closures, and an end can no longer precede the start.

1.15.0 — Features & defaults, change notifications

• Admins needed instance-wide defaults (panel shown, Kanban on/off, Nager import, phase preselection) without code changes.
• People were surprised by edits to their plan made by others; the booked person and the PM are now notified, coalesced so a drag is one line.

1.16.0 — Bookable as a resource

• Whether someone appeared as staff depended on their role, so working admins could not be booked and non-working accounts cluttered the lists. It is now a per-user switch.

1.17.0 — Booking segments

• A person often works a few days at the start and a few at the end of a phase. Bookings can be unlinked from the phase, carry their own dates, be booked several times without overlapping, and follow the phase when it moves.

2.0.0 — Project fields, My Work, searchable pickers

• Tag groups were being stretched into structured project data. Admins now define real project fields (dropdown, multi-select, text, number, switch); the built-in fields can be renamed or hidden.
• My Work replaces My Todos and focuses on what people act on: approvals to decide, their own assignments, their own requests. Bookings get a comment thread.
• Every people picker gets a search box — with dozens of people per site, scrolling a list no longer scales.

Breaking changes (2.0.0)

1. Tag groups became project fields. Existing groups are converted automatically on upgrade (single-select → dropdown, otherwise multi-select) with their items, colours, order, site/team limits and project selections; /api/tag-groups, tags.group_id and tag_groups are removed. Gantt filter/grouping/colour preferences saved before 2.0.0 reset once.
2. Personal tasks removed before shipping. The todos feature of 1.13.0 (tasks, /api/todos, the todos.* permissions and task notifications) is gone; My Work keeps only approvals, assignments and requests.

Upgrade

Automatic: the tenant auto-migrations create the team, RBAC, booking-segment and project-field schema and convert tag groups on first pool creation (single-tenant: at startup). The SQL files (add_teams, add_rbac, add_change_notifications, add_user_is_resource, add_booking_segments, add_project_fields) remain available through run_migration.py. The demo seed (app/scripts/demo_data.py) covers the new data — teams, roles and a pending approval, unlinked bookings, project fields — and the docs screenshots were refreshed from it.

Tests and coverage

• Backend: 3682 passed; frontend: 3430 passed.
• Suite floors raised to the new measured totals: fail_under = 91 in pyproject.toml, coverage.thresholds (lines 92.6, statements 91.5, functions 93.1, branches 83.3) in frontend/vitest.config.ts.

Code scanning

This PR also closes the open CodeQL findings that were real: the SSO log lines carried a truncated digest of the client secret (now only "set/missing"), SSO redirects now accept only tenant slugs and same-origin paths (a configured redirect URI whose path began with // could become a scheme-relative redirect), and the workflows default to contents: read. Two findings stay open by design for a decision: the one-time generated bootstrap admin password printed by init_db / master_db on a fresh install (documented, must be changed at first login).