fix: audit fix pass #1 — all 19 verified HIGH findings + critical dep cleanup

Fixes every CRITICAL/HIGH finding from the 2026-06-09 full-codebase audit
(REVIEW_FINDINGS.md); each fix went through independent spec + code-quality
review. Plan and per-task log: docs/superpowers/plans/2026-06-10-audit-high-fix-pass.md

- attendance: schemas accept the combined local datetimes the forms/service
  use (new dateTimeString helpers in schemas/common.ts), breaks persist on
  create, AttendanceCreate submit rebuilt — every submit 400'd since 519edce
- 2fa: backup codes wired to /totp/backup-verify (+ remember-me parity),
  enrollment QR generated locally via qrcode (CSP-blocked external service
  also leaked the secret), dashboard shows per-user enrollment, not policy
- invoices/orders: per-line VAT survives re-saves (numberOr 0-respecting
  coercion in formatters.ts), billing_text persists on update, issued-order
  status transitions update UI gates
- trips: real pagination on all 3 pages, GET /trips/stats server aggregate
  (shared buildTripsWhere + legacy distance coalesce), vehicle_id applies on
  PUT with both-vehicle odometer recompute, print rebuilt (sync window.open,
  escaped template, server totals)
- orders api: attachment_data PDF blob excluded from all non-binary reads
- warehouse: unit field is a Select over UnitEnum, receipt attachments
  downloadable via new authenticated GET route
- downloads: shared RFC 5987 contentDisposition helper — Czech filenames no
  longer 500 (warehouse, received-invoices, orders endpoints)
- misc: block-env hook actually blocks (exit 2 + stderr), project create
  works with empty dates, NaN filter guards on trips endpoints
- deps: remove unused concurrently (clears both critical advisories), pin
  @hono/node-server >=1.19.13 via overrides (clears the 3 moderates without
  the Prisma 6 downgrade), drop deprecated @types stubs

Gates: tsc -b clean - vitest 30 files / 342 tests (31 new) - eslint 0 errors
- build OK

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/admin/pages/TripsHistory.tsx

@@ -5,12 +5,19 @@ import { useAuth } from "../context/AuthContext";
 import Forbidden from "../components/Forbidden";
 import { formatDate } from "../utils/attendanceHelpers";
 import { formatKm } from "../utils/formatters";
-import { tripHistoryOptions, tripVehiclesOptions } from "../lib/queries/trips";
+import {
+  tripHistoryOptions,
+  tripStatsOptions,
+  tripVehiclesOptions,
+  type BackendTrip,
+} from "../lib/queries/trips";
+import { usePaginatedQuery } from "../hooks/usePaginatedQuery";
 import {
   Card,
   DataTable,
   Select,
   MonthField,
+  Pagination,
   StatusChip,
   PageHeader,
   PageEnter,
@@ -91,18 +98,35 @@ export default function TripsHistory() {
     return `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}`;
   });
   const [vehicleId, setVehicleId] = useState("");
+  const [page, setPage] = useState(1);
 
   const { data: vehiclesData = [] } = useQuery(tripVehiclesOptions());
   const vehicles = vehiclesData;
 
-  const { data: tripsData, isPending } = useQuery(
+  const {
+    items: tripsData,
+    pagination,
+    isPending,
+  } = usePaginatedQuery<BackendTrip>(
     tripHistoryOptions({
       month,
       vehicleId: vehicleId ? Number(vehicleId) : undefined,
       userId: user?.id,
+      page,
+    }),
+  );
+
+  // Stat cards: month totals over the WHOLE filtered set (server-side
+  // aggregate over the same filters), not just the visible page.
+  const { data: stats } = useQuery(
+    tripStatsOptions({
+      month,
+      vehicleId: vehicleId ? Number(vehicleId) : undefined,
+      userId: user?.id,
     }),
   );
-  const trips: Trip[] = (tripsData ?? []).map((t) => ({
+
+  const trips: Trip[] = tripsData.map((t) => ({
     id: t.id,
     trip_date: t.trip_date,
     spz: t.vehicles?.spz ?? "",
@@ -118,14 +142,11 @@ export default function TripsHistory() {
     notes: t.notes ?? undefined,
   }));
 
-  const totals = trips.reduce(
-    (acc, t) => ({
-      total: acc.total + (t.distance || 0),
-      business: acc.business + (t.is_business ? t.distance || 0 : 0),
-      count: acc.count + 1,
-    }),
-    { total: 0, business: 0, count: 0 },
-  );
+  const totals = {
+    count: stats?.count ?? 0,
+    total: stats?.total_km ?? 0,
+    business: stats?.business_km ?? 0,
+  };
 
   if (!hasPermission("trips.history")) return <Forbidden />;
 
@@ -221,12 +242,21 @@ export default function TripsHistory() {
       {/* Filters */}
       <FilterBar>
         <Box sx={{ flex: "0 0 180px" }}>
-          <MonthField value={month} onChange={(val) => setMonth(val)} />
+          <MonthField
+            value={month}
+            onChange={(val) => {
+              setMonth(val);
+              setPage(1);
+            }}
+          />
         </Box>
         <Box sx={{ flex: "0 0 220px" }}>
           <Select
             value={vehicleId}
-            onChange={(value) => setVehicleId(value)}
+            onChange={(value) => {
+              setVehicleId(value);
+              setPage(1);
+            }}
             options={[
               { value: "", label: "Všechna vozidla" },
               ...vehicles.map((v) => ({
@@ -275,14 +305,21 @@ export default function TripsHistory() {
         {isPending ? (
           <LoadingState />
         ) : (
-          <DataTable<Trip>
-            columns={columns}
-            rows={trips}
-            rowKey={(trip) => trip.id}
-            empty={
-              <EmptyState title="Žádné záznamy jízd pro vybrané období." />
-            }
-          />
+          <>
+            <DataTable<Trip>
+              columns={columns}
+              rows={trips}
+              rowKey={(trip) => trip.id}
+              empty={
+                <EmptyState title="Žádné záznamy jízd pro vybrané období." />
+              }
+            />
+            <Pagination
+              page={page}
+              pageCount={pagination?.total_pages ?? 1}
+              onChange={setPage}
+            />
+          </>
         )}
       </Card>
     </PageEnter>