feat(fusion_clock): redesign dashboard — layered, role-aware, gradient cards (dark+light)

- Rework /fusion_clock/dashboard_data into a personal block (everyone)
  plus a team block (team lead = direct reports, manager = org-wide).
  A regular employee's payload never contains another employee's data.
- New OWL stacked layout: gradient KPI cards (Today/Week/OT/Streak),
  Today's Shift, Recent Activity, Upcoming Leave, Recent Penalties; team
  band adds Present/Absent/Late/Pending, roster, and Needs Attention.
- Dark/light via compile-time $o-webclient-color-scheme branching;
  drop the old runtime html.o_dark dashboard block.
- Open the Dashboard menu to group_fusion_clock_user (lead/manager imply).
- Add HttpCase permission/no-leak tests. Bump 3.13.2 -> 3.14.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fusion_clock/views/clock_menus.xml

@@ -24,13 +24,15 @@
               sequence="46"
               groups="group_fusion_clock_kiosk_app"/>
 
-    <!-- Dashboard -->
+    <!-- Dashboard — layered & role-aware: personal band for everyone,
+         team band for leads (direct reports), org band for managers.
+         Gated to the base clock-user group (lead/manager imply it). -->
     <menuitem id="menu_fusion_clock_dashboard"
               name="Dashboard"
               parent="menu_fusion_clock_root"
               action="action_fusion_clock_dashboard"
               sequence="5"
-              groups="group_fusion_clock_manager,group_fusion_clock_team_lead"/>
+              groups="group_fusion_clock_user"/>
 
     <!-- ============================================================
          Attendance — day-to-day operational records