HR

Fixed and merged to dev on nuvita-hr.

Worked from the ticket's own description - the source audit document this ticket's "Findings covered" list points to (clinq-docs/modules/hr/reviews/2026-09-28-ui-audit/, branch docs/hr-ui-audit-2026-09-28) does not exist anywhere in clinq-docs or nuvita-hr, local or remote. Flagging that separately (see #137) rather than guessing at the missing finding-code detail; this ticket's own text was self-contained enough to act on directly.

• Added apps/portal/src/guards/ui-conventions.test.ts (new - didn't exist), built from nuvita-opd's and nuvita-diagnostics's existing guards (same rule shape, PENDING/EXEMPT convention). Bans em-dash, window.confirm, a raw error surfaced directly in a toast, a fake toast.success with no real mutation behind it, a static "AI" label, a local components/ui folder, plus the HR-specific ban on .toISOString().slice(0,10) outside the new clock helper. The backend half of that ban (DateOnly.FromDateTime(DateTime.UtcNow)) can't be enforced by this guard (it's a frontend-only text scanner) - documented as a code-review convention instead, since no backend text-scanning guard exists anywhere on this platform to extend.
• Added a friendlyError helper (ported from OPD/diagnostics' equivalent, trimmed to HR's actual error shape).
• Added one hospital-local-day clock helper shared by API and portal (HrIstDay / hospital-day.ts), following the exact pattern nuvita-pharmacy and nuvita-billing already established for this same problem. Wired through 5 call sites as a working demonstration (2 frontend, 2 backend, plus validation logic) - 31 more backend call sites and a few frontend ones are intentionally left unmigrated per the ticket's own "don't migrate every call site" instruction; flagged with exact locations in case someone wants to continue that sweep.
• Removed one confirmed-dead export (buildProxyUrl, zero references anywhere).

Flagged, not fixed here (belongs to #141's "Truth" scope, which is running in parallel): a fake "Save draft" toast.success in leave-requests/new/page.tsx with no backing API call.

Tests: HR backend unit 1221/1221 passed; HR frontend 103/103 files, 790/790 tests passed, type-check clean.