feat(time-tracking) : migrate TimeEntry into TimeTracking module (back)

First business module of Phase 2 (LST-64, rodage). Strangler-style,
additive move — no behavioural change to the public API or MCP tools.

- New module App\Module\TimeTracking (TimeTrackingModule, id "time-tracking",
  declares time-tracking.entries.view/export permissions in the RBAC catalog;
  operation security left on ROLE_USER, not re-wired here).
- Move TimeEntry entity, repository (now interface + Doctrine impl bound in
  services.yaml), ActiveTimeEntryProvider, export service/controller and the
  4 MCP TimeEntry tools into the module. #[ApiResource] (operations, security,
  uriTemplates /time_entries/*), filters and serialization groups preserved.
- Doctrine mapping "TimeTracking" added; table time_entry unchanged.
- Sidebar item gated with module "time-tracking" (SidebarFilter disables the
  route when the module is inactive).
- Timestampable/Blamable adopted (first adopter): additive migration adds
  created_at/updated_at/created_by/updated_by (nullable, FK SET NULL) +
  COMMENT ON COLUMN. Functional test confirms created_at on persist and
  updated_at refresh on update — the suspected preUpdate recompute issue does
  not occur (Doctrine ORM 3.6.2 recomputes change sets after preUpdate).

159 tests green, schema mapping valid, php-cs-fixer clean.

src/Module/TimeTracking/Infrastructure/Mcp/Tool/UpdateTimeEntryTool.php

@@ -0,0 +1,99 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\TimeTracking\Infrastructure\Mcp\Tool;
+
+use App\Mcp\Tool\Serializer;
+use App\Module\TimeTracking\Domain\Repository\TimeEntryRepositoryInterface;
+use App\Repository\ProjectRepository;
+use App\Repository\TaskRepository;
+use App\Repository\TaskTagRepository;
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-time-entry', description: 'Update a time entry. Use to stop an active timer by providing stoppedAt, or to correct start time. userId is not updatable.')]
+class UpdateTimeEntryTool
+{
+    public function __construct(
+        private readonly TimeEntryRepositoryInterface $timeEntryRepository,
+        private readonly ProjectRepository $projectRepository,
+        private readonly TaskRepository $taskRepository,
+        private readonly TaskTagRepository $taskTagRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    /**
+     * @param int[] $tagIds IDs of the tags to attach
+     */
+    public function __invoke(
+        int $id,
+        ?string $title = null,
+        ?string $startedAt = null,
+        ?string $stoppedAt = null,
+        ?int $projectId = null,
+        ?int $taskId = null,
+        ?array $tagIds = null,
+        ?string $description = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $entry = $this->timeEntryRepository->findById($id);
+
+        if (null === $entry) {
+            throw new InvalidArgumentException(sprintf('TimeEntry with ID %d not found.', $id));
+        }
+
+        if (null !== $title) {
+            $entry->setTitle($title);
+        }
+        if (null !== $startedAt) {
+            $entry->setStartedAt(new DateTimeImmutable($startedAt));
+        }
+        if (null !== $stoppedAt) {
+            $entry->setStoppedAt(new DateTimeImmutable($stoppedAt));
+        }
+        if (null !== $description) {
+            $entry->setDescription($description);
+        }
+        if (null !== $projectId) {
+            $project = $this->projectRepository->find($projectId);
+            if (null === $project) {
+                throw new InvalidArgumentException(sprintf('Project with ID %d not found.', $projectId));
+            }
+            $entry->setProject($project);
+        }
+        if (null !== $taskId) {
+            $task = $this->taskRepository->find($taskId);
+            if (null === $task) {
+                throw new InvalidArgumentException(sprintf('Task with ID %d not found.', $taskId));
+            }
+            $entry->setTask($task);
+        }
+        if (null !== $tagIds) {
+            foreach ($entry->getTags()->toArray() as $existingTag) {
+                $entry->removeTag($existingTag);
+            }
+            foreach ($tagIds as $tagId) {
+                $tag = $this->taskTagRepository->find($tagId);
+                if (null === $tag) {
+                    throw new InvalidArgumentException(sprintf('TaskTag with ID %d not found.', $tagId));
+                }
+                $entry->addTag($tag);
+            }
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::timeEntry($entry));
+    }
+}