fix: code review — XSS, type safety, validation improvements

Critical:
- InvoiceDetail: sanitize notes HTML with DOMPurify
- OrderDetail: use proper DOMPurify import instead of window fallback

Important:
- AttendanceBalances: add fund_to_date to interface, remove as-any casts
- All schemas: replace z.any() with z.preprocess for boolean fields
- Routes: simplify boolean coercion (Zod handles it now)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/schemas/trips.schema.ts

@@ -11,7 +11,7 @@ export const CreateTripSchema = z.object({
   end_km: z.union([z.number(), z.string()]).transform((v) => Number(v)),
   route_from: z.string(),
   route_to: z.string(),
-  is_business: z.any().optional().default(false),
+  is_business: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(false),
   notes: z.string().nullish(),
 });
 
@@ -27,7 +27,7 @@ export const UpdateTripSchema = z.object({
     .optional(),
   route_from: z.string().optional(),
   route_to: z.string().optional(),
-  is_business: z.any().optional(),
+  is_business: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
   notes: z.string().nullish(),
 });