fix: audit fix pass #1 — all 19 verified HIGH findings + critical dep cleanup

Fixes every CRITICAL/HIGH finding from the 2026-06-09 full-codebase audit
(REVIEW_FINDINGS.md); each fix went through independent spec + code-quality
review. Plan and per-task log: docs/superpowers/plans/2026-06-10-audit-high-fix-pass.md

- attendance: schemas accept the combined local datetimes the forms/service
  use (new dateTimeString helpers in schemas/common.ts), breaks persist on
  create, AttendanceCreate submit rebuilt — every submit 400'd since 519edce
- 2fa: backup codes wired to /totp/backup-verify (+ remember-me parity),
  enrollment QR generated locally via qrcode (CSP-blocked external service
  also leaked the secret), dashboard shows per-user enrollment, not policy
- invoices/orders: per-line VAT survives re-saves (numberOr 0-respecting
  coercion in formatters.ts), billing_text persists on update, issued-order
  status transitions update UI gates
- trips: real pagination on all 3 pages, GET /trips/stats server aggregate
  (shared buildTripsWhere + legacy distance coalesce), vehicle_id applies on
  PUT with both-vehicle odometer recompute, print rebuilt (sync window.open,
  escaped template, server totals)
- orders api: attachment_data PDF blob excluded from all non-binary reads
- warehouse: unit field is a Select over UnitEnum, receipt attachments
  downloadable via new authenticated GET route
- downloads: shared RFC 5987 contentDisposition helper — Czech filenames no
  longer 500 (warehouse, received-invoices, orders endpoints)
- misc: block-env hook actually blocks (exit 2 + stderr), project create
  works with empty dates, NaN filter guards on trips endpoints
- deps: remove unused concurrently (clears both critical advisories), pin
  @hono/node-server >=1.19.13 via overrides (clears the 3 moderates without
  the Prisma 6 downgrade), drop deprecated @types stubs

Gates: tsc -b clean - vitest 30 files / 342 tests (31 new) - eslint 0 errors
- build OK

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/admin/context/AuthContext.tsx

@@ -122,7 +122,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
       }
     },
     [],
-  );  
+  );
 
   const silentRefresh = useCallback(async (): Promise<boolean> => {
     // Deduplicate concurrent refresh calls — token rotation means only one call can succeed
@@ -260,17 +260,32 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     ) => {
       setError(null);
       try {
-        const response = await fetch(`${API_BASE}/login/totp`, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          credentials: "include",
-          body: JSON.stringify({
-            login_token: loginToken,
-            totp_code: code,
-            remember_me: remember,
-            isBackup,
-          }),
-        });
+        // Backup codes have their own endpoint + schema (8-char codes would
+        // fail /login/totp's strict 6-digit TotpVerifySchema). Both endpoints
+        // complete the same login flow: tokens issued + refresh cookie set.
+        const response = await fetch(
+          isBackup
+            ? `${API_BASE}/totp/backup-verify`
+            : `${API_BASE}/login/totp`,
+          {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            credentials: "include",
+            body: JSON.stringify(
+              isBackup
+                ? {
+                    login_token: loginToken,
+                    backup_code: code,
+                    remember_me: remember,
+                  }
+                : {
+                    login_token: loginToken,
+                    totp_code: code,
+                    remember_me: remember,
+                  },
+            ),
+          },
+        );
         const data = await response.json();
         if (data.success) {
           setAccessTokenFn(data.data.access_token, data.data.expires_in);