feat(attendance): add geofence monitoring and policy controls

docs/BACKEND/API_GUIDES/V2/README.md

@@ -21,10 +21,11 @@ What was validated live against the deployed stack:
 - client sign-in
 - staff auth bootstrap
 - client dashboard, billing, coverage, hubs, vendors, managers, team members, orders, and reports
-- client hub and order write flows
+- client coverage incident feed for geofence and override review
+- client hub, order, coverage review, and late-worker cancellation flows
 - client invoice approve and dispute
 - staff dashboard, availability, payments, shifts, profile sections, documents, certificates, attire, bank accounts, benefits, and time card
-- staff availability, profile, tax form, bank account, shift apply, shift accept, clock-in, clock-out, and swap request
+- staff availability, profile, tax form, bank account, shift apply, shift accept, clock-in, clock-out, location stream upload, and swap request
 - direct file upload helpers and verification job creation through the unified host
 - client and staff sign-out
 
@@ -76,7 +77,36 @@ All routes return the same error envelope:
 }
 ```
 
-## 4) Route model
+## 4) Attendance policy and monitoring
+
+V2 now supports an explicit attendance proof policy:
+
+- `NFC_REQUIRED`
+- `GEO_REQUIRED`
+- `EITHER`
+
+The effective policy is resolved as:
+
+1. shift override if present
+2. hub default if present
+3. fallback to `EITHER`
+
+For geofence-heavy staff flows, frontend should read the policy from:
+
+- `GET /staff/clock-in/shifts/today`
+- `GET /staff/shifts/:shiftId`
+- `GET /client/hubs`
+
+Important operational rules:
+
+- outside-geofence clock-ins can be accepted only when override is enabled and a written reason is provided
+- NFC mismatches are rejected and are not overrideable
+- background location streams are stored as raw batch payloads in the private v2 bucket and summarized in SQL for query speed
+- incident review lives on `GET /client/coverage/incidents`
+- confirmed late-worker recovery is exposed on `POST /client/coverage/late-workers/:assignmentId/cancel`
+- queued manager alerts are written to `notification_outbox`; this is durable notification orchestration, not a full push delivery worker yet
+
+## 5) Route model
 
 Frontend sees one base URL and one route shape:
 
@@ -94,7 +124,7 @@ Internally, the gateway still forwards to:
 | writes and workflow actions | `command-api-v2` |
 | reads and mobile read models | `query-api-v2` |
 
-## 5) Frontend integration rule
+## 6) Frontend integration rule
 
 Use the unified routes first.
 
@@ -106,7 +136,7 @@ Do not build new frontend work on:
 
 Those routes still exist for backend/internal compatibility, but mobile/frontend migration should target the unified surface documented in [Unified API](./unified-api.md).
 
-## 6) Docs
+## 7) Docs
 
 - [Unified API](./unified-api.md)
 - [Core API](./core-api.md)