Fix test failures and workload/websocket behavior

backend/app/api/workload/router.py

@@ -139,7 +139,7 @@ async def get_heatmap(
         description="Comma-separated list of user IDs to include"
     ),
     hide_empty: bool = Query(
-        True,
+        False,
         description="Hide users with no tasks assigned for the week"
     ),
     db: Session = Depends(get_db),
@@ -168,8 +168,20 @@ async def get_heatmap(
     if department_id:
         check_workload_access(current_user, department_id=department_id)
 
-    # Filter user_ids based on access (pass db for manager department lookup)
-    accessible_user_ids = filter_accessible_users(current_user, parsed_user_ids, db)
+    # Determine accessible users for this requester
+    accessible_user_ids = filter_accessible_users(current_user, None, db)
+
+    # If specific user_ids are requested, ensure access is permitted
+    if parsed_user_ids:
+        if accessible_user_ids is not None:
+            requested_ids = set(parsed_user_ids)
+            allowed_ids = set(accessible_user_ids)
+            if not requested_ids.issubset(allowed_ids):
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail="Access denied: Cannot view other users' workload",
+                )
+        accessible_user_ids = parsed_user_ids
 
     # Normalize week_start
     if week_start is None: