[nooby6]

Summary

• Add authenticated GET /api/v1/reports/staffing-hours with startsAt and endsAt parameters.
• Aggregate scheduled shift count, distinct employee count, and scheduled hours by department in one PostgreSQL query.
• Clip each shift's hours to the requested window; exclude cancelled shifts and shifts outside the window; sort results by department.
• Reject invalid time windows and document the endpoint.

Tests

• Service mapping, empty-result and invalid-window unit tests.
• MVC tests for authentication and response shape.
• PostgreSQL integration test for overlap clipping, aggregation, cancelled shifts, and out-of-window shifts.

Closes #18. CI must pass before merge.