feat(presence): check-in/out + present/attendance actions

Self-only (member resolved server-side, never from input), validated
service-client writes (no client RLS write policy). checkIn enforces
host eligibility via spaces.host_requires_card + active-card count,
blocks a fresh double check-in, and auto-closes a stale open visit
before a new one (handles forgotten check-outs without a cron).
checkOut closes the caller's open visit. listPresentNow (any member;
staleness applied in pure logic), getMyVisits (/me), listAttendance
(all members, last 250). Zod checkIn/checkOut schemas; barrel export.

lib/validations.ts

@@ -970,6 +970,17 @@ export const doorControlSchema = z.object({
   verb: z.enum(['open', 'unlock', 'lock']),
 })
 
+// ─── Presence / attendance ───────────────────────────────────────────────────
+
+export const checkInSchema = z.object({
+  asHost: z.boolean().optional().default(false),
+  note: z.string().max(500).optional().nullable(),
+})
+
+export const checkOutSchema = z.object({
+  note: z.string().max(500).optional().nullable(),
+})
+
 // ─── Generic ID schemas ──────────────────────────────────────────────────────
 
 export const uuidSchema = z.string().uuid('Invalid ID format')