fix: audit fix pass #1 — all 19 verified HIGH findings + critical dep cleanup

Fixes every CRITICAL/HIGH finding from the 2026-06-09 full-codebase audit
(REVIEW_FINDINGS.md); each fix went through independent spec + code-quality
review. Plan and per-task log: docs/superpowers/plans/2026-06-10-audit-high-fix-pass.md

- attendance: schemas accept the combined local datetimes the forms/service
  use (new dateTimeString helpers in schemas/common.ts), breaks persist on
  create, AttendanceCreate submit rebuilt — every submit 400'd since 519edce
- 2fa: backup codes wired to /totp/backup-verify (+ remember-me parity),
  enrollment QR generated locally via qrcode (CSP-blocked external service
  also leaked the secret), dashboard shows per-user enrollment, not policy
- invoices/orders: per-line VAT survives re-saves (numberOr 0-respecting
  coercion in formatters.ts), billing_text persists on update, issued-order
  status transitions update UI gates
- trips: real pagination on all 3 pages, GET /trips/stats server aggregate
  (shared buildTripsWhere + legacy distance coalesce), vehicle_id applies on
  PUT with both-vehicle odometer recompute, print rebuilt (sync window.open,
  escaped template, server totals)
- orders api: attachment_data PDF blob excluded from all non-binary reads
- warehouse: unit field is a Select over UnitEnum, receipt attachments
  downloadable via new authenticated GET route
- downloads: shared RFC 5987 contentDisposition helper — Czech filenames no
  longer 500 (warehouse, received-invoices, orders endpoints)
- misc: block-env hook actually blocks (exit 2 + stderr), project create
  works with empty dates, NaN filter guards on trips endpoints
- deps: remove unused concurrently (clears both critical advisories), pin
  @hono/node-server >=1.19.13 via overrides (clears the 3 moderates without
  the Prisma 6 downgrade), drop deprecated @types stubs

Gates: tsc -b clean - vitest 30 files / 342 tests (31 new) - eslint 0 errors
- build OK

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/admin/pages/InvoiceDetail.tsx

@@ -51,7 +51,12 @@ import { invoiceDetailOptions } from "../lib/queries/invoices";
 import { offerCustomersOptions } from "../lib/queries/offers";
 import { bankAccountsOptions } from "../lib/queries/common";
 import { jsonQuery } from "../lib/apiAdapter";
-import { formatCurrency, formatDate, todayLocalStr } from "../utils/formatters";
+import {
+  formatCurrency,
+  formatDate,
+  numberOr,
+  todayLocalStr,
+} from "../utils/formatters";
 import { normalizeDateStr } from "../utils/attendanceHelpers";
 import {
   Button,
@@ -686,7 +691,7 @@ export default function InvoiceDetail() {
       tax_date: normalizeDateStr(inv.tax_date),
       currency: inv.currency || "CZK",
       apply_vat: Number(inv.apply_vat) ? 1 : 0,
-      vat_rate: Number(inv.vat_rate) || 21,
+      vat_rate: numberOr(inv.vat_rate, 21),
       payment_method: inv.payment_method || "Příkazem",
       constant_symbol: inv.constant_symbol || "0308",
       issued_by: inv.issued_by || "",
@@ -725,7 +730,11 @@ export default function InvoiceDetail() {
             quantity: Number(item.quantity) || 1,
             unit: item.unit || "",
             unit_price: Number(item.unit_price) || 0,
-            vat_rate: Number(inv.vat_rate) || 21,
+            // Per-line VAT: hydrate from the ITEM's own stored rate (a real DB
+            // column returned by the detail endpoint) — falling back to the
+            // invoice-level rate only when the line carries none. Hydrating
+            // from the invoice rate corrupted mixed-rate invoices on re-save.
+            vat_rate: numberOr(item.vat_rate, numberOr(inv.vat_rate, 21)),
           }))
         : [];
     if (mappedItems.length > 0) {
@@ -781,8 +790,10 @@ export default function InvoiceDetail() {
     // Pre-fill from order
     if (fromOrderId && orderDataQuery.data) {
       const order = orderDataQuery.data;
-      const vatRate =
-        Number(order.vat_rate) || (companySettings?.default_vat_rate ?? 21);
+      const vatRate = numberOr(
+        order.vat_rate,
+        companySettings?.default_vat_rate ?? 21,
+      );
       setForm((prev) => ({
         ...prev,
         customer_id: order.customer_id as number,