fix: score endpoint now returns total_violations and negated_count

The /api/employees/:id/score endpoint previously only returned data from
the active_cpas_scores view (active_points + violation_count for the 90-day
window). The EmployeeModal score cards reference total_violations and
negated_count which were undefined, causing blank displays.

Now queries the violations table directly for all-time totals alongside
the rolling 90-day active data.

server.js

@@ -128,10 +128,29 @@ app.patch('/api/employees/:id/notes', (req, res) => {
   res.json({ id, notes: newNotes });
 });
 
-// Employee score (current snapshot)
+// Employee score (current snapshot) — includes total violations + negated count
 app.get('/api/employees/:id/score', (req, res) => {
-  const row = db.prepare('SELECT * FROM active_cpas_scores WHERE employee_id = ?').get(req.params.id);
+  const empId = req.params.id;
-  res.json(row || { employee_id: req.params.id, active_points: 0, violation_count: 0 });
+
+  // Active points from the 90-day rolling view
+  const active = db.prepare('SELECT * FROM active_cpas_scores WHERE employee_id = ?').get(empId);
+
+  // Total violations (all time) and negated count
+  const totals = db.prepare(`
+    SELECT
+      COUNT(*)                    AS total_violations,
+      COALESCE(SUM(negated), 0)  AS negated_count
+    FROM violations
+    WHERE employee_id = ?
+  `).get(empId);
+
+  res.json({
+    employee_id:      empId,
+    active_points:    active ? active.active_points    : 0,
+    violation_count:  active ? active.violation_count   : 0,
+    total_violations: totals ? totals.total_violations  : 0,
+    negated_count:    totals ? totals.negated_count     : 0,
+  });
 });
 
 // ── Expiration Timeline ──────────────────────────────────────────────────────