fix(fusion_clock): stop stale missed-clock-in nag; add Owner role + attendance exemption

The "explain your missed clock-out" dialog (driven by hr.employee.
x_fclk_pending_reason) was set by the absence + auto-clock-out crons but only
cleared by the systray reason dialog -- never by the kiosk/NFC clock paths that
staff actually use. During the kiosk rollout the absence cron flagged the whole
company (hundreds of "absent" logs); those stale flags then nagged everyone
forever, even while currently clocked in.

Fixes:
- Clear x_fclk_pending_reason on every successful clock-in (portal, systray,
  PIN kiosk, NFC kiosk). Back on the clock => no nag.
- get_status / dashboard never report pending while checked-in or exempt; the
  systray also guards the dialog client-side.
- Absence detection no longer sets x_fclk_pending_reason (an absence has no
  "departure time" to explain). It still logs 'absent' + notifies the office.
- One-time migration (19.0.4.2.0) clears existing stale flags.

Owner / attendance exemption:
- New "Owner" role (top of the Fusion Clock access dropdown, implies Manager)
  plus a per-employee "Exempt from Attendance" checkbox.
- hr.employee._fclk_is_attendance_exempt(); the absence, auto-clock-out,
  reminder and weekly-summary crons all skip exempt employees, and the dialog
  is suppressed for them.

Tests: tests/test_pending_reason_exempt.py (13 cases). Full fusion_clock suite
green except pre-existing env-sensitive failures.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fusion_clock/security/security.xml

@@ -49,6 +49,18 @@
         <field name="comment">Can manage locations, view all attendance, generate reports</field>
     </record>
 
+    <!-- Owner: top of the role ladder. Carries ALL Manager permissions but is
+         exempt from attendance automation (no absence flags, no auto-clock-out
+         nag, no reminders, no missed-clock-out dialog). For owners/principals
+         who work but are not "on the clock". Implies Manager, so it renders as
+         the highest role in the single Fusion Clock access dropdown. -->
+    <record id="group_fusion_clock_owner" model="res.groups">
+        <field name="name">Owner</field>
+        <field name="privilege_id" ref="res_groups_privilege_fusion_clock"/>
+        <field name="implied_ids" eval="[(4, ref('group_fusion_clock_manager'))]"/>
+        <field name="comment">Full Clock management; exempt from attendance tracking, reminders and missed-clock alerts.</field>
+    </record>
+
     <!-- Dedicated kiosk-operator permission: can run the shared clock kiosk
          (NFC tap / PIN) WITHOUT full Clock Manager access. Gates the
          "Fusion Clock Kiosk" app menu and is accepted by the kiosk controllers.