feat(shifts): add Shift CRUD API with sign-up/cancel and capacity management

- ShiftService with 7 methods: list, detail, create, update, delete, signup, cancel
- 5 DTOs: ShiftListDto, ShiftDetailDto, CreateShiftRequest, UpdateShiftRequest, ShiftSignupDto
- Minimal API endpoints: GET /api/shifts, GET /api/shifts/{id}, POST, PUT, DELETE, POST /signup, DELETE /signup
- Capacity validation: sign-up rejected when full → 409 Conflict
- Past shift blocking: cannot sign up for past shifts → 422 Unprocessable
- Duplicate signup prevention: check existing before create → 409 Conflict
- Concurrency: 2-attempt retry loop for last-slot race conditions
- Authorization: POST/PUT (Manager+), DELETE (Admin), signup/cancel (Member+)
- Test infrastructure: Added X-Test-UserId header support for member ID injection
- 13 TDD integration tests: CRUD, sign-up, capacity, past shift, concurrency
- Build: 0 errors (6 BouncyCastle warnings expected)

Task 15 complete. Wave 3: 3/5 tasks done.

backend/WorkClub.Api/Program.cs

@@ -3,6 +3,7 @@ using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.EntityFrameworkCore;
 using WorkClub.Api.Auth;
+using WorkClub.Api.Endpoints.Shifts;
 using WorkClub.Api.Endpoints.Tasks;
 using WorkClub.Api.Middleware;
 using WorkClub.Api.Services;
@@ -28,6 +29,7 @@ builder.Services.AddHttpContextAccessor();
 builder.Services.AddScoped<ITenantProvider, TenantProvider>();
 builder.Services.AddScoped<SeedDataService>();
 builder.Services.AddScoped<TaskService>();
+builder.Services.AddScoped<ShiftService>();
 
 builder.Services.AddSingleton<TenantDbConnectionInterceptor>();
 builder.Services.AddSingleton<SaveChangesTenantInterceptor>();
@@ -121,6 +123,7 @@ app.MapGet("/api/test", () => Results.Ok(new { message = "Test endpoint" }))
     .RequireAuthorization();
 
 app.MapTaskEndpoints();
+app.MapShiftEndpoints();
 
 app.Run();