feat(03-05): technician service, compensation service, APIs, and 27 passing tests

- technician-service.ts: createTechnicianProfile, updateTechnicianProfile, getTechnicianProfile, getTechnicianProfileByUserId, listTechnicians
- compensation-service.ts: getCompensationSummary (all 3 models), getTechnicianCompensationDetail (job-by-job)
- 6 API routes: GET/POST /api/technicians, GET/PUT /api/technicians/[id], GET /api/technicians/[id]/compensation, GET/POST /api/job-type-rates, PUT /api/job-type-rates/[id], GET /api/reports/compensation
- Added TechnicianProfile and JobTypeRate to CASL AppSubjects; OFFICE_STAFF read access
- 27 integration tests: all 3 models, missing rate defaults to 0, only COMPLETED count, date range filter, summary+detail reports, cross-tenant isolation — all green

src/lib/casl/permissions.ts

@@ -57,6 +57,11 @@ export function definePermissionsFor(
       can("manage", "Ticket");
       // Job order management
       can("manage", "JobOrder");
+      // Technician profile management (read/update, not create — admin only for compensation config)
+      can("read", "TechnicianProfile");
+      can("update", "TechnicianProfile");
+      // Job type rates (read-only for office staff — admin configures rates)
+      can("read", "JobTypeRate");
       // View financial reports (read-only)
       can("read", "Report");
       // View accounting (read-only, cannot modify Chart of Accounts)