fix(fusion_clock): stop stale missed-clock-in nag; add Owner role + attendance exemption

The "explain your missed clock-out" dialog (driven by hr.employee.
x_fclk_pending_reason) was set by the absence + auto-clock-out crons but only
cleared by the systray reason dialog -- never by the kiosk/NFC clock paths that
staff actually use. During the kiosk rollout the absence cron flagged the whole
company (hundreds of "absent" logs); those stale flags then nagged everyone
forever, even while currently clocked in.

Fixes:
- Clear x_fclk_pending_reason on every successful clock-in (portal, systray,
  PIN kiosk, NFC kiosk). Back on the clock => no nag.
- get_status / dashboard never report pending while checked-in or exempt; the
  systray also guards the dialog client-side.
- Absence detection no longer sets x_fclk_pending_reason (an absence has no
  "departure time" to explain). It still logs 'absent' + notifies the office.
- One-time migration (19.0.4.2.0) clears existing stale flags.

Owner / attendance exemption:
- New "Owner" role (top of the Fusion Clock access dropdown, implies Manager)
  plus a per-employee "Exempt from Attendance" checkbox.
- hr.employee._fclk_is_attendance_exempt(); the absence, auto-clock-out,
  reminder and weekly-summary crons all skip exempt employees, and the dialog
  is suppressed for them.

Tests: tests/test_pending_reason_exempt.py (13 cases). Full fusion_clock suite
green except pre-existing env-sensitive failures.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fusion_clock/controllers/clock_api.py

@@ -287,6 +287,11 @@ class FusionClockAPI(http.Controller):
 
                 attendance.sudo().write(write_vals)
 
+                # A successful clock-in resolves any pending missed-clock-out flag,
+                # so the employee is never nagged once they are back on the clock.
+                if employee.x_fclk_pending_reason:
+                    employee.sudo().write({'x_fclk_pending_reason': False})
+
                 # Log clock-in
                 self._log_activity(
                     employee, 'clock_in',
@@ -542,7 +547,10 @@ class FusionClockAPI(http.Controller):
             'is_checked_in': is_checked_in,
             'employee_name': employee.name,
             'enable_clock': employee.x_fclk_enable_clock,
-            'pending_reason': employee.x_fclk_pending_reason,
+            # Only nag when there is genuinely something to explain: a flag set,
+            # the employee NOT currently on the clock, and not attendance-exempt.
+            'pending_reason': (employee.x_fclk_pending_reason and not is_checked_in
+                               and not employee._fclk_is_attendance_exempt()),
             'ontime_streak': employee.x_fclk_ontime_streak,
         }
         local_today = get_local_today(request.env, employee)
@@ -728,7 +736,8 @@ class FusionClockAPI(http.Controller):
             'is_checked_in': is_checked_in,
             'check_in': check_in,
             'location_name': location_name,
-            'pending_reason': employee.x_fclk_pending_reason,
+            'pending_reason': (employee.x_fclk_pending_reason and not is_checked_in
+                               and not employee._fclk_is_attendance_exempt()),
             'today_hours': today_hours,
             'week_hours': week_hours,
             'overtime_week': round(employee.x_fclk_overtime_this_week or 0, 2),