fix: code review — XSS, type safety, validation improvements

Critical:
- InvoiceDetail: sanitize notes HTML with DOMPurify
- OrderDetail: use proper DOMPurify import instead of window fallback

Important:
- AttendanceBalances: add fund_to_date to interface, remove as-any casts
- All schemas: replace z.any() with z.preprocess for boolean fields
- Routes: simplify boolean coercion (Zod handles it now)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/schemas/company-settings.schema.ts

@@ -16,7 +16,7 @@ export const UpdateCompanySettingsSchema = z.object({
     .union([z.number(), z.string()])
     .transform((v) => Number(v))
     .optional(),
-  require_2fa: z.any().optional(),
+  require_2fa: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
   custom_fields: z.array(z.any()).optional(),
   supplier_field_order: z.array(z.any()).optional(),
 });