fix: reliable timesheet saves in Docker (surface errors, 0.5h steps, node middleware)

[flo-kn]

Summary

Fixes timesheet hour edits appearing to save but silently not persisting on the Docker/Supabase deployment, plus two related robustness/UX improvements.

1. Surface save errors instead of swallowing them (the reported bug)

handleSave awaited each Supabase insert/update/delete without checking the returned error, then always showed "Changes saved!". When a write was rejected — most commonly the hours CHECK constraint (0 <= hours <= 24) returning HTTP 400 — the failure was swallowed. The UI reported success, nothing persisted, and on reload the old value reappeared while dashboard totals never changed, so it looked like saved hours had vanished.

Now every write checks its error and throws on failure so the real message is shown, and a pre-save validation flags out-of-range hours per day before the request is sent.

2. Restrict hours to 0.5 increments

The input used a 0.25 step (too granular). Changed to 0.5 and enforced half-hour increments in the pre-save validation, since the step attribute alone is only a soft browser hint.

3. Migrate middleware.ts → proxy.ts (Node.js runtime)

Separate latent bug found while investigating: on this codebase (Next 16.0.10 + Turbopack) the legacy middleware.ts convention still defaults to the edge runtime — verified via middleware-manifest.json referencing server/edge/chunks/*. In the edge runtime the internal SUPABASE_URL (http://kong:8000) is not readable server-side, so session refresh in Docker fell back to the public URL and failed with repeated AuthRetryableFetchError: fetch failed, breaking refresh after the 1h JWT expiry.

Fixed idiomatically by migrating to the Next 16 proxy.ts convention, which defaults to the Node.js runtime (no runtime option needed — setting one in a proxy file throws). This keeps session refresh on Node so the internal URL is read as intended, removes the runtime landmine for the recommended middleware→proxy codemod, and silences the middleware convention is deprecated build warning.

Testing

• Reproduced the exact failure against Kong/PostgREST: PATCH with hours > 24 → 400 23514 violates check constraint time_entries_hours_check (matches the browser request seen in Kong access logs); valid values persist.
• Rebuilt/redeployed the app container for each change; app responds 200.
• Post-migration: empty middleware-manifest.json, no edge chunk references updateSession, /dashboard → 307 /auth/login, login 200, zero fetch failed after restart.

Manual check to confirm: enter an hours value over 24 and verify the hint appears instead of a false "saved".