fix: code review — XSS, type safety, validation improvements

Critical:
- InvoiceDetail: sanitize notes HTML with DOMPurify
- OrderDetail: use proper DOMPurify import instead of window fallback

Important:
- AttendanceBalances: add fund_to_date to interface, remove as-any casts
- All schemas: replace z.any() with z.preprocess for boolean fields
- Routes: simplify boolean coercion (Zod handles it now)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/schemas/orders.schema.ts

@@ -14,7 +14,7 @@ const OrderItemSchema = z.object({
     .transform((v) => Number(v) || 0)
     .optional()
     .default(0),
-  is_included_in_total: z.any().optional().default(true),
+  is_included_in_total: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
   position: z
     .union([z.number(), z.string()])
     .transform((v) => Number(v))
@@ -55,7 +55,7 @@ export const CreateOrderSchema = z.object({
     .transform((v) => Number(v))
     .optional()
     .default(21.0),
-  apply_vat: z.any().optional().default(true),
+  apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
   exchange_rate: z
     .union([z.number(), z.string()])
     .transform((v) => Number(v))
@@ -82,7 +82,7 @@ export const UpdateOrderSchema = z.object({
     .union([z.number(), z.string()])
     .transform((v) => Number(v))
     .optional(),
-  apply_vat: z.any().optional(),
+  apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
   items: z.array(OrderItemSchema).optional(),
   sections: z.array(OrderSectionSchema).optional(),
 });