fix(visits): formalize visit lifecycle and site scoping

[devcavin]

Summary

This PR completes the formalizing visit lifecycle rules and correcting site handling across visit registration and overdue processing.

Changes

• Resolve the target site explicitly from RegisterVisitRequest.siteId instead of deriving it from requestedBy.site.
• Preserve AuthorizationService.assertCovers() as the authorization boundary for visit registration.
• Keep zone and visitor profile lookups site-scoped.
• Ensure both VisitorProfile and Visit are associated with the resolved target site.
• Prevent a visitor profile from having multiple active visits (CHECKED_IN or OVERDUE).
• Allow checkout from both CHECKED_IN and OVERDUE.
• Reject checkout from CHECKED_OUT and other invalid lifecycle states.
• Simplify OverdueVisitJob to perform a single global lifecycle update rather than iterating through sites without actually scoping the update.
• Keep site-specific dashboard insight as a query/presentation concern rather than coupling it to the overdue state-transition job.

Authorization

The registration flow now distinguishes between:

• requestedBy - the actor performing the operation.
• request.siteId - the target site of the operation.
• targetSite - the resolved domain entity used by the visit and visitor profile.

This preserves global ADMIN access while keeping MANAGER and STAFF restricted to their assigned site.

Lifecycle

CHECKED_IN ──► CHECKED_OUT
     │
     └──► OVERDUE ──► CHECKED_OUT

Only CHECKED_IN and OVERDUE visits can be checked out.

Issue resolution

Closes #43 - Resolve target site for visit creation

Closes #41 - Fix OverdueVisitJob to Scope Processing by Site