fix: code review — XSS, type safety, validation improvements

Critical:
- InvoiceDetail: sanitize notes HTML with DOMPurify
- OrderDetail: use proper DOMPurify import instead of window fallback

Important:
- AttendanceBalances: add fund_to_date to interface, remove as-any casts
- All schemas: replace z.any() with z.preprocess for boolean fields
- Routes: simplify boolean coercion (Zod handles it now)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/schemas/users.schema.ts

@@ -7,7 +7,7 @@ export const CreateUserSchema = z.object({
   first_name: z.string().min(1, "Jméno je povinné"),
   last_name: z.string().min(1, "Příjmení je povinné"),
   role_id: z.union([z.number(), z.string()]).transform((v) => Number(v)),
-  is_active: z.any().optional().default(true),
+  is_active: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
 });
 
 export const UpdateUserSchema = z.object({
@@ -17,7 +17,7 @@ export const UpdateUserSchema = z.object({
   first_name: z.string().optional(),
   last_name: z.string().optional(),
   role_id: z.union([z.number(), z.string(), z.null()]).optional(),
-  is_active: z.any().optional(),
+  is_active: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
 });
 
 export type CreateUserInput = z.infer<typeof CreateUserSchema>;