feat: add Kropáček Ondřej + May–Jul feature work (half-cell marks, copy/paste, exports, roles)

New worker: Kropáček Ondřej (TKB, part-time student) inserted between
Dvořák Václav and Vondrák Pavel in data.json, the full-month Excel
template (new row 13, everything below shifted) and the docházka
template (13 person rows). Not added to the harmonogram/CIS roster —
he has no CIS personal number.

Also checkpoints the uncommitted work deployed to production between
May and July 2026:
- half-cell day/night preference marks (color + text per half)
- cell copy/paste (Ctrl+C/V, context menu), incl. from info rows
- light/dark theme toggle, TKB people filter, 162 filter
- full-month Excel export (template) and harmonogram export for CIS
- docházka export: half-time workers, retired flag, contractor handling
- third login role "cis" (viewer + export access)
- retired flag hides a person from UI/FPD while keeping past data

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

web/src/Login.tsx

@@ -4,17 +4,22 @@ const VALID_USER = 'tkb'
 const VALID_PASS = 'sluzby'
 const VIEWER_USER = 'prohlizec'
 const VIEWER_PASS = 'pohled'
+const CIS_USER = 'cis'
+const CIS_PASS = 'import'
 const AUTH_KEY = 'tkb_auth'
 const ROLE_KEY = 'tkb_role'
 
-export type UserRole = 'editor' | 'viewer'
+export type UserRole = 'editor' | 'viewer' | 'cis'
 
 export function isAuthenticated(): boolean {
   return localStorage.getItem(AUTH_KEY) === 'true'
 }
 
 export function getAuthRole(): UserRole {
-  return localStorage.getItem(ROLE_KEY) === 'viewer' ? 'viewer' : 'editor'
+  const r = localStorage.getItem(ROLE_KEY)
+  if (r === 'viewer') return 'viewer'
+  if (r === 'cis') return 'cis'
+  return 'editor'
 }
 
 function setAuthenticated(role: UserRole): void {
@@ -44,6 +49,9 @@ export function Login({ onLogin }: LoginProps) {
     } else if (username === VIEWER_USER && password === VIEWER_PASS) {
       setAuthenticated('viewer')
       onLogin('viewer')
+    } else if (username === CIS_USER && password === CIS_PASS) {
+      setAuthenticated('cis')
+      onLogin('cis')
     } else {
       setError(true)
       setTimeout(() => setError(false), 3000)