fix: 8 pre-existing Test-Fehler behoben

1. Krankmeldungen an Wochenenden erlaubt (working_days=0 für SICK)
   Medizinisch korrekt: Krankmeldungen können auch Wochenendtage umfassen.
   Behebt: test_create_absence_sick_auto_approved, test_quick_sick_*,
           test_pull_includes_today_absence_with_category, test_sick_stats_*

2. Self-Approval-Schutz in Tests berücksichtigt
   abs_approver_headers / time_approver_headers: zweiter Admin je Company.
   Behebt: test_approve_absence, test_balance_deducted_after_approve, test_approve_entry

3. test_export_invalid_format: "pdf" → "xml" (pdf ist jetzt valides Format)

Ergebnis: 134/134 passed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_time.py

@@ -28,6 +28,25 @@ async def manager_headers(client: AsyncClient):
     return {"Authorization": f"Bearer {token}"}
 
 
+@pytest_asyncio.fixture(scope="session", loop_scope="session")
+async def time_approver_headers(client: AsyncClient, manager_headers):
+    """Zweiter Admin in Time GmbH – kann Zeiteinträge anderer genehmigen."""
+    resp = await client.post("/api/v1/users/invite", json={
+        "first_name": "Time",
+        "last_name": "Approver",
+        "email": "approver@timegmbh.de",
+        "role": "COMPANY_ADMIN",
+        "initial_password": "Secret123",
+    }, headers=manager_headers)
+    assert resp.status_code == 201, resp.text
+    login = await client.post("/api/v1/auth/login", json={
+        "email": "approver@timegmbh.de",
+        "password": "Secret123",
+    })
+    assert login.status_code == 200, login.text
+    return {"Authorization": f"Bearer {login.json()['access_token']}"}
+
+
 # ── Stamp In / Out ─────────────────────────────────────────────────────────────
 
 @pytest.mark.asyncio
@@ -175,8 +194,8 @@ async def test_update_entry(client: AsyncClient, auth_headers):
 
 
 @pytest.mark.asyncio
-async def test_approve_entry(client: AsyncClient, manager_headers):
-    """Manager genehmigt einen Eintrag."""
+async def test_approve_entry(client: AsyncClient, manager_headers, time_approver_headers):
+    """Manager genehmigt einen Eintrag eines anderen Benutzers (kein Self-Approval)."""
     create_resp = await client.post(
         "/api/v1/time/entries",
         json={
@@ -193,7 +212,7 @@ async def test_approve_entry(client: AsyncClient, manager_headers):
 
     resp = await client.post(
         f"/api/v1/time/entries/{entry_id}/approve",
-        headers=manager_headers,
+        headers=time_approver_headers,
     )
     assert resp.status_code == 200
     assert resp.json()["status"] == "approved"