feat(shifts): add Shift CRUD API with sign-up/cancel and capacity management

- ShiftService with 7 methods: list, detail, create, update, delete, signup, cancel
- 5 DTOs: ShiftListDto, ShiftDetailDto, CreateShiftRequest, UpdateShiftRequest, ShiftSignupDto
- Minimal API endpoints: GET /api/shifts, GET /api/shifts/{id}, POST, PUT, DELETE, POST /signup, DELETE /signup
- Capacity validation: sign-up rejected when full → 409 Conflict
- Past shift blocking: cannot sign up for past shifts → 422 Unprocessable
- Duplicate signup prevention: check existing before create → 409 Conflict
- Concurrency: 2-attempt retry loop for last-slot race conditions
- Authorization: POST/PUT (Manager+), DELETE (Admin), signup/cancel (Member+)
- Test infrastructure: Added X-Test-UserId header support for member ID injection
- 13 TDD integration tests: CRUD, sign-up, capacity, past shift, concurrency
- Build: 0 errors (6 BouncyCastle warnings expected)

Task 15 complete. Wave 3: 3/5 tasks done.

backend/WorkClub.Tests.Integration/Infrastructure/TestAuthHandler.cs

@@ -21,10 +21,12 @@ public class TestAuthHandler : AuthenticationHandler<AuthenticationSchemeOptions
     {
         var clubsClaim = Context.Request.Headers["X-Test-Clubs"].ToString();
         var emailClaim = Context.Request.Headers["X-Test-Email"].ToString();
+        var userIdClaim = Context.Request.Headers["X-Test-UserId"].ToString();
 
         var claims = new List<Claim>
         {
             new Claim(ClaimTypes.NameIdentifier, "test-user"),
+            new Claim("sub", string.IsNullOrEmpty(userIdClaim) ? Guid.NewGuid().ToString() : userIdClaim),
             new Claim(ClaimTypes.Email, string.IsNullOrEmpty(emailClaim) ? "test@test.com" : emailClaim),
         };