Recover core shift request API

[LoopyB]

Summary

Reimplements the core Shift Request backend functionality from PR #328 against
the current backend architecture.

Changes

• Added a ShiftRequest model with validation for leave and swap requests
• Added guard request creation
• Added guard access to their own requests
• Added employer access scoped to shifts they created or active branches they own
• Added employer/admin approval and rejection
• Enforced valid status transitions from PENDING
• Added focused service and controller tests

Endpoints

• POST /api/v1/shifts/request
• GET /api/v1/shifts/requests
• GET /api/v1/shifts/request/:id
• PATCH /api/v1/shifts/request/:id

Deliberately excluded

• Socket.IO changes
• Notification infrastructure changes
• Frontend and Guard App changes
• Request cancellation
• Target-guard response workflow
• Broad shift lifecycle refactors

Existing notification and shift lifecycle APIs remain unchanged.

Validation

• Targeted ESLint passed
• Shift Request service tests passed
• Shift Request controller tests passed
• 2 test suites passed
• 10 tests passed
• git diff --check passed

Scope

This is a narrow recovery of the core backend request workflow only.

Supersedes PR #328.