Fix attendance check-in and check-out validation flow

[LoopyB]

Summary

Fixes the attendance check-in/check-out flow so it works with the current data model and validates guard assignment and shift location correctly.

What changed

• aligned shiftattendance.controller.js with the current ShiftAttendance schema

  • use shift / guard instead of old shiftId / guardId
  • use clockIn / clockOut
  • populate required scheduledStart / scheduledEnd

• validate guard is assigned to the shift before check-in/check-out

• validate shift has stored location.latitude / location.longitude

• validate guard is within 100m radius before check-in

• prevent duplicate check-in

• prevent duplicate check-out

• fix attendance history query to use guard and sort by clockIn

Testing

Tested manually via Swagger:

• check-in success returns 201
• duplicate check-in returns 400 Already checked in
• check-out success returns 200
• duplicate check-out returns 400 Already checked out
• out-of-radius check-in returns 400 Not within shift radius (100m)

Notes

• location validation is enforced in the controller against stored shift coordinates
• the current ShiftAttendance schema does not store check-in/check-out GeoJSON fields, so this PR aligns with the existing model rather than extending it

[LoopyB]

Note: backend lint issues identified in CI have been cleaned up and package-lock.json was synced so npm ci can run. The remaining failing check is the repo-wide Prettier format:check, which currently reports existing style issues across many backend files unrelated to this attendance change. I have not included a mass-format of 68 files in this PR to keep the ticket scoped and reviewable.