fix: code review — XSS, type safety, validation improvements

Critical:
- InvoiceDetail: sanitize notes HTML with DOMPurify
- OrderDetail: use proper DOMPurify import instead of window fallback

Important:
- AttendanceBalances: add fund_to_date to interface, remove as-any casts
- All schemas: replace z.any() with z.preprocess for boolean fields
- Routes: simplify boolean coercion (Zod handles it now)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/routes/admin/vehicles.ts

@@ -108,9 +108,7 @@ export default async function vehiclesRoutes(
             body.actual_km !== undefined ? Number(body.actual_km) : undefined,
           is_active:
             body.is_active !== undefined
-              ? body.is_active === true ||
-                body.is_active === 1 ||
-                body.is_active === "1"
+              ? !!body.is_active
               : undefined,
         },
       });