feat: export attendance per user

[CK-7vn]

Description of the change

This ticket implements the ability for administrators to export singular user attendance for both active and deactivated residents.

• Related issues: https://app.asana.com/1/1201607307149189/project/1209460078641109/task/1212245767551168?focus=true

Screenshot(s)

Additional context

Backend Changes:

• Added ResidentAttendanceCSVData struct and ResidentAttendanceToCSVFormat() function to backend/src/models/users.go
• Added GetResidentAttendanceCSVData() database query to backend/src/database/users.go
• Added GET /api/users/{id}/attendance-export endpoint in backend/src/handlers/user_handler.go
• Added LoginMetrics to test migrations in backend/src/database/DB.go

Frontend Changes:

• Added 'Export Attendance' to ResidentAccountAction enum in frontend/src/common.ts
• Added "Export Attendance" action to UserActionsDropdown.tsx (visible for both active and deactivated residents)
• Added downloadAttendanceExport() handler in frontend/src/Pages/ResidentProfile.tsx

CSV Output:

• Headers: Program Name, Class Name, Session Date, Attendance Status, Note
• Sorted by Program (alphabetical) → Class (alphabetical) → Date (chronological)
• Attendance statuses displayed as: Present, Absent Excused, Absent Unexcused

Security Features:

• Uses validatedAdminRoute with UserRoleResolver middleware (same auth as viewing profile)
• Facility admins can only export attendance for residents in their own facility
• Students cannot access this endpoint
• Audit logging captures user_id and rows_exported

Edge Cases Handled:

• No attendance records: Returns CSV with headers only
• Deactivated residents: Can still export historical attendance (button remains visible)
• Enrollment date filtering: Only includes attendance recorded during active enrollment period

Integration Tests Added:

• backend/tests/integration/user_attendance_export_test.go with 8 test scenarios covering:
  • Successful CSV export with data
  • Facility boundary enforcement
  • Empty attendance records
  • Deactivated resident export
  • Enrollment date filtering
  • CSV sorting validation
  • Student role access denial

Decisions Made:

• Export only sessions with recorded attendance (not all sessions during enrollment) - simpler and more performant
• No success toast after download trigger - the browser's download dialog provides sufficient feedback
• Button visible for deactivated residents to allow historical data access

Known Limitations:

• CSV export only (PDF format not implemented)
• No date range filtering (exports all historical attendance)

[CK-7vn]

The vulnerability in the provider middleware is inside of the standard library, the only way we can fix it is upgrading our Go version, which is done in the reports ticket to 1.25, which doens't have the vulnerability, so....Don't know how everyone wnats to go about that, just wait for the reports PR to get merged?

[carddev81]

Tested good and looks great!! Good job!

[corypride]

Tests good.