1.5.2

- feat: order confirmation PDF generation with VAT support
- feat: order confirmation modal with custom item editing
- fix: attendance negative duration clamping and switchProject timing
- fix: Quill editor locked to Tahoma 14px, PDF heading sizes
- fix: invoice/offer PDF font consistency (Tahoma enforcement)
- fix: invoice alert cron improvements
- fix: NAS financials manager edge cases
- refactor: numbering service with unique sequence constraints

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/server.ts

@@ -29,13 +29,16 @@ import totpRoutes from "./routes/admin/totp";
 import scopeTemplatesRoutes from "./routes/admin/scope-templates";
 import invoicesPdfRoutes from "./routes/admin/invoices-pdf";
 import offersPdfRoutes from "./routes/admin/offers-pdf";
+import ordersPdfRoutes from "./routes/admin/orders-pdf";
 import projectFilesRoutes from "./routes/admin/project-files";
 
 const app = Fastify({
   logger: {
     level: config.isProduction ? "warn" : "info",
   },
-  trustProxy: true,
+  trustProxy: config.isProduction
+    ? ["127.0.0.1", "192.168.50.100"]
+    : ["127.0.0.1", "::1"],
   bodyLimit: 1048576,
 });
 
@@ -57,6 +60,12 @@ async function start() {
 
   await app.register(cookie);
 
+  // --- Health check (before rate-limit so monitoring isn't throttled) ---
+  app.get("/api/health", async () => ({
+    status: "ok",
+    timestamp: new Date().toISOString(),
+  }));
+
   await app.register(rateLimit, {
     max: 300,
     timeWindow: "1 minute",
@@ -116,16 +125,11 @@ async function start() {
   });
   await app.register(invoicesPdfRoutes, { prefix: "/api/admin/invoices-pdf" });
   await app.register(offersPdfRoutes, { prefix: "/api/admin/offers-pdf" });
+  await app.register(ordersPdfRoutes, { prefix: "/api/admin/orders-pdf" });
   await app.register(projectFilesRoutes, {
     prefix: "/api/admin/project-files",
   });
 
-  // --- Health check ---
-  app.get("/api/health", async () => ({
-    status: "ok",
-    timestamp: new Date().toISOString(),
-  }));
-
   // --- Frontend: Vite dev middleware (dev only) ---
   if (!config.isProduction) {
     const viteModule = await (Function(