refactor: streamline visit lifecycle and service architecture

[devcavin]

Summary

This refactor consolidates the visit lifecycle, time handling, authorization,
repository queries, and service-level entity access patterns introduced
throughout the recent backend changes.

Changes

Time and visit lifecycle

• Introduced TimeUtil as the centralized UTC time utility.
• Added helpers for:
  • current UTC time
  • start of today
  • start of tomorrow
  • end of today
  • overnight visit detection
  • configurable time offsets such as hours ago
• Updated visit creation and time-sensitive logic to use centralized time handling.
• Introduced overnight visit semantics based on the check-in date.
• Kept overdue processing separate from overnight detection.

Dashboard and repository

• Consolidated dashboard visit queries in VisitRepository.
• Added scope-aware queries supporting both:
  • global ADMIN access
  • site-scoped MANAGER/STAFF access
• Simplified currently-on-premises, checked-in, checked-out, overdue,
  active visitor, overdue visitor, and recently checked-out queries.
• Removed redundant repository methods made unnecessary by the consolidated queries.

Overdue processing

• Refactored OverdueVisitJob to use TimeUtil.
• Kept the overdue threshold configurable.
• Simplified overdue processing so the repository performs the update
  without unnecessary per-site iteration.
• Maintained the transition from CHECKED_IN to OVERDUE.

Authorization

• Kept AuthorizationService as the single source of truth for access scope.
• Preserved explicit Global and Site access scopes.
• Removed redundant authorization helpers where existing authorization
  assertions already covered the required behavior.
• Preserved resource-level authorization for visits and users.
• Ensured explicit target site IDs remain usable by globally scoped ADMINs
  rather than deriving target sites from requestedBy.site.

Visit services

• Removed duplicated individual visit lookups by reusing
  findAccessibleVisit().
• Centralized visit existence and authorization checks for operations such as
  viewing and checking out visits.
• Updated visit time handling to use the centralized time provider/utilities.
• Preserved returning-visitor and visit registration behavior.

Visitor profiles

• Removed duplicated profile lookup logic within the service.
• Kept visitor-profile authorization explicitly tied to the profile's site.
• Preserved site-scoped visit counting and duplicate phone validation.

Reports

• Aligned visitor report generation with the centralized time conventions.
• Preserved authorization and VisitSpecification filtering.
• Preserved CSV duration calculation from actual check-in/check-out times.

Sites, users, and zones

• Refactored entity lookup patterns to reduce repeated findById /
  ResourceNotFoundException logic.
• Introduced the optional BaseEntityService abstraction for reusable
  entity lookup/delete behavior, without forcing it into services where
  specialized authorization or deletion logic is required.
• Updated site, user, visitor-profile, and zone service patterns accordingly.
• Preserved explicit site authorization for site-scoped operations.
• Kept target-site operations compatible with global ADMIN access.

Design principles

The refactor reinforces several architectural boundaries:

• TimeUtil owns application-level UTC time calculations.
• AuthorizationService owns access-scope decisions.
• Repositories own persistence/query concerns.
• Services own business rules and authorization orchestration.
• Overnight status is derived from the visit timeline rather than treated
  as an arbitrary scheduler state.
• ADMIN remains globally scoped, while MANAGER and STAFF remain site scoped.

Notes

No new BaseEntityService dependency was forced into the domain services.
The abstraction is available for future services where it provides clear
value without obscuring domain-specific behavior.