fix: audit fix pass #1 — all 19 verified HIGH findings + critical dep cleanup

Fixes every CRITICAL/HIGH finding from the 2026-06-09 full-codebase audit
(REVIEW_FINDINGS.md); each fix went through independent spec + code-quality
review. Plan and per-task log: docs/superpowers/plans/2026-06-10-audit-high-fix-pass.md

- attendance: schemas accept the combined local datetimes the forms/service
  use (new dateTimeString helpers in schemas/common.ts), breaks persist on
  create, AttendanceCreate submit rebuilt — every submit 400'd since 519edce
- 2fa: backup codes wired to /totp/backup-verify (+ remember-me parity),
  enrollment QR generated locally via qrcode (CSP-blocked external service
  also leaked the secret), dashboard shows per-user enrollment, not policy
- invoices/orders: per-line VAT survives re-saves (numberOr 0-respecting
  coercion in formatters.ts), billing_text persists on update, issued-order
  status transitions update UI gates
- trips: real pagination on all 3 pages, GET /trips/stats server aggregate
  (shared buildTripsWhere + legacy distance coalesce), vehicle_id applies on
  PUT with both-vehicle odometer recompute, print rebuilt (sync window.open,
  escaped template, server totals)
- orders api: attachment_data PDF blob excluded from all non-binary reads
- warehouse: unit field is a Select over UnitEnum, receipt attachments
  downloadable via new authenticated GET route
- downloads: shared RFC 5987 contentDisposition helper — Czech filenames no
  longer 500 (warehouse, received-invoices, orders endpoints)
- misc: block-env hook actually blocks (exit 2 + stderr), project create
  works with empty dates, NaN filter guards on trips endpoints
- deps: remove unused concurrently (clears both critical advisories), pin
  @hono/node-server >=1.19.13 via overrides (clears the 3 moderates without
  the Prisma 6 downgrade), drop deprecated @types stubs

Gates: tsc -b clean - vitest 30 files / 342 tests (31 new) - eslint 0 errors
- build OK

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/__tests__/invoices.service.test.ts

@@ -1,6 +1,12 @@
-import { describe, it, expect } from "vitest";
+import { describe, it, expect, afterEach } from "vitest";
 import { Prisma } from "@prisma/client";
-import { invoiceTotalWithVat } from "../services/invoices.service";
+import prisma from "../config/database";
+import {
+  invoiceTotalWithVat,
+  createInvoice,
+  updateInvoice,
+} from "../services/invoices.service";
+import { UpdateInvoiceSchema } from "../schemas/invoices.schema";
 
 // `invoiceTotalWithVat` receives a Prisma row whose money columns are real
 // `Prisma.Decimal` instances (the model maps `@db.Decimal` → Decimal). Using
@@ -118,3 +124,58 @@ describe("invoiceTotalWithVat", () => {
     expect(invoiceTotalWithVat(inv)).toBe(968);
   });
 });
+
+/* -------------------------------------------------------------------------- */
+/* PUT regression — billing_text must survive UpdateInvoiceSchema             */
+/* -------------------------------------------------------------------------- */
+
+// The PUT route does `parseBody(UpdateInvoiceSchema, body)` and hands the
+// PARSED data to `updateInvoice`. UpdateInvoiceSchema is a plain z.object,
+// which STRIPS unknown keys — so a field missing from the schema is silently
+// dropped before the service ever sees it, while the client still gets a
+// success response. This block mirrors that exact flow against the real DB.
+
+describe("updateInvoice — billing_text round-trips through UpdateInvoiceSchema", () => {
+  const invoiceIds: number[] = [];
+
+  afterEach(async () => {
+    for (const id of invoiceIds)
+      await prisma.invoices.deleteMany({ where: { id } });
+    invoiceIds.length = 0;
+  });
+
+  it("persists an edited billing_text (the schema must not strip it)", async () => {
+    const draft = await createInvoice({ billing_text: "Původní text" });
+    invoiceIds.push(draft.id);
+
+    // Mirror the route: raw body -> UpdateInvoiceSchema -> updateInvoice.
+    const parsed = UpdateInvoiceSchema.parse({
+      billing_text: "Fakturujeme Vám dle objednávky č. 123",
+    });
+    expect(parsed.billing_text).toBe("Fakturujeme Vám dle objednávky č. 123");
+
+    const res = await updateInvoice(draft.id, parsed);
+    expect("error" in res).toBe(false);
+
+    const row = await prisma.invoices.findUnique({ where: { id: draft.id } });
+    expect(row?.billing_text).toBe("Fakturujeme Vám dle objednávky č. 123");
+  });
+
+  it("clears billing_text when null is sent, and leaves it untouched when absent", async () => {
+    const draft = await createInvoice({ billing_text: "Text na PDF" });
+    invoiceIds.push(draft.id);
+
+    // Absent from the body -> updateInvoice's `!== undefined` guard skips it.
+    await updateInvoice(draft.id, UpdateInvoiceSchema.parse({ notes: "x" }));
+    let row = await prisma.invoices.findUnique({ where: { id: draft.id } });
+    expect(row?.billing_text).toBe("Text na PDF");
+
+    // Explicit null -> cleared (the strFields path maps falsy -> null).
+    await updateInvoice(
+      draft.id,
+      UpdateInvoiceSchema.parse({ billing_text: null }),
+    );
+    row = await prisma.invoices.findUnique({ where: { id: draft.id } });
+    expect(row?.billing_text).toBeNull();
+  });
+});