feat(actuals): implement full Cartesian grid with filters and pagination

Backend:
- Add ActualController with Cartesian product query (all projects × members)
- Add ActualsService for variance calculations (∞% when actual>0, allocated=0)
- Add ActualResource for API response formatting
- Add migration for notes column on actuals table
- Add global config for inactive project logging (ALLOW_ACTUALS_ON_INACTIVE_PROJECTS)
- Implement filters: project_ids[], team_member_ids[], include_inactive, search
- Add pagination support (25 per page default)
- Register /api/actuals routes

Frontend:
- Create MultiSelect component with portal rendering (z-index fix for sidebar)
  - Compact trigger mode to prevent badge overflow
  - SSR-safe with browser guards
  - Keyboard navigation and accessibility
- Create Pagination component with smart ellipsis
- Rebuild actuals page with:
  - Full Cartesian matrix (shows all projects × members, not just allocations)
  - Filter section with project/member multi-select
  - Active filters display area with badge wrapping
  - URL persistence for all filter state
  - Month navigation with arrows
  - Variance display (GREEN ≤5%, YELLOW 5-20%, RED >20%, ∞% for zero allocation)
  - Read-only cells for inactive projects
  - Modal for incremental hours logging with notes
- Add actualsService with unwrap:false to preserve pagination meta
- Add comprehensive TypeScript types for grid items and pagination

OpenSpec:
- Update actuals-tracking spec with clarified requirements
- Mark Capability 6: Actuals Tracking as complete in tasks.md
- Update test count: 157 backend tests passing

Fixes:
- SSR error: Add browser guards to portal rendering
- Z-index: Use portal to escape stacking context (sidebar z-30)
- Filter overlap: Separate badge display from dropdown triggers
- Member filter: Derive visible members from API response data
- Pagination meta: Disable auto-unwrap to preserve response structure

openspec/changes/headroom-foundation/specs/actuals-tracking/spec.md

@@ -16,42 +16,45 @@ The system SHALL allow team members to log actual hours worked per project per m
 - **WHEN** attempting to log hours for a month that hasn't started yet
 - **THEN** the system rejects the request with validation error "Cannot log hours for future months"
 
-### Requirement: Update logged hours
-The system SHALL allow team members to update previously logged hours for the current month.
+### Requirement: Update logged hours (incremental)
+The system SHALL allow team members to update previously logged hours using incremental updates.
 
 #### Scenario: Incremental weekly updates
 - **WHEN** a team member logs 10 hours in week 1 of February
 - **AND** logs an additional 8 hours in week 2 of February
 - **AND** the system updates the total to 18 hours for February
 - **THEN** the system accumulates the hours for the monthly aggregate
+- **AND** the system preserves all notes from each update
 
-#### Scenario: Replace monthly total
-- **WHEN** a team member updates February actuals from 35 hours to 40 hours
-- **THEN** the system replaces the previous value with the new total
-
-### Requirement: View actuals summary
-The system SHALL display actual hours worked in a summary view similar to allocation matrix.
+### Requirement: View actuals summary with variance
+The system SHALL display actual hours worked in a matrix view showing allocated, actual, and variance data.
 
 #### Scenario: View monthly actuals matrix
 - **WHEN** a manager views actuals for February 2026
 - **THEN** the system displays projects as rows and team members as columns
-- **AND** each cell shows actual hours logged for that project-person combination
+- **AND** each cell shows:
+  - **Allocated hours** (from allocation records)
+  - **Actual hours** (from actuals records)
+  - **Variance %** = ((Actual - Allocated) / Allocated) × 100
+  - **Variance indicator**: GREEN (≤5%), YELLOW (5-20%), RED (>20%)
 
-#### Scenario: Show actuals vs allocations
-- **WHEN** viewing the actuals summary
-- **THEN** the system displays allocated hours and actual hours side by side
-- **AND** the system highlights variances (over or under)
+#### Scenario: Show variance indicators
+- **WHEN** viewing the actuals matrix
+- **THEN** cells are color-coded based on variance:
+  - GREEN: Within ±5% of allocation (on track)
+  - YELLOW: 5-20% variance (attention needed)
+  - RED: >20% variance (significant deviation)
 
 ### Requirement: Cannot log hours to inactive projects
-The system SHALL prevent logging hours to projects in "Done" or "Cancelled" status (configurable).
+The system SHALL prevent logging hours to projects in "Done" or "Cancelled" status (configurable via global setting).
 
 #### Scenario: Attempt to log hours to done project
 - **WHEN** attempting to log hours for a project with status "Done"
-- **AND** the system configuration prevents logging to completed projects
+- **AND** the global system configuration `allow_actuals_on_inactive_projects` is false
 - **THEN** the system rejects the request with error "Cannot log hours to completed projects"
 
 #### Scenario: Allow logging to done project if configured
-- **WHEN** the system is configured to allow logging to completed projects
+- **WHEN** the global configuration `allow_actuals_on_inactive_projects` is true
 - **AND** a team member logs hours to a "Done" project
 - **THEN** the system accepts the hours (for edge cases where work continues after project closure)
 
@@ -73,6 +76,6 @@ The system SHALL allow optional notes when logging hours.
 - **WHEN** a team member logs 40 hours with notes "Focused on API development and bug fixes"
 - **THEN** the system stores the notes alongside the hours logged
 
-#### Scenario: Update notes
-- **WHEN** a team member updates the notes for a logged actuals record
-- **THEN** the system updates the notes field without affecting the hours value
+#### Scenario: View notes in matrix
+- **WHEN** viewing the actuals matrix
+- **THEN** clicking on a cell shows the history of logged hours with timestamps and notes