security: fix all Medium findings from FLAWS_REPORT audit

- Auth: TOTP replay protection with counter tracking, constant-time
  backup code comparison, atomic lockout increment, per-token logout
- Invoices/PDFs: net-based VAT calculation, dangerous URL scheme
  stripping in cleanQuillHtml, orders-pdf error handling
- Orders: reject item changes on status transition, cascading
  delete cleanup, take:1 with orderBy
- Projects: atomic rename collision handling, MIME/extension
  validation, empty customer name rejection
- Attendance: Czech public holiday awareness in frontend fund
  calculation, leave_hours 0 handling, invalid date NaN guard,
  bounded per-month queries in workfund
- Users/Admin: profile audit logging + password validation, session
  revocation guard, session ID validation, dashboard DB aggregation,
  soft-deleted record protection in scope templates
- Frontend: FormField label linkage, Pagination ARIA, error
  handling in OrderConfirmationModal, 401 propagation, GPS emoji
  hidden from screen readers, table sort state fix, geolocation
  race/abort cleanup, Leaflet popup DOM safety, Vehicles toggleActive
  minimal body, CompanySettings ref mutation fix, OfferDetail unlock
  abort, AttendanceBalances combined fetches
- Utils: env validation, Puppeteer concurrency mutex, invoice alert
  cron cleanup on shutdown, body limit alignment, TOTP error logging,
  trustProxy from env, symlink rejection, rate cache Map usage

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

prisma/schema.prisma

@@ -46,7 +46,7 @@ model attendance_project_logs {
   hours         Int?       @db.UnsignedInt
   minutes       Int?       @db.UnsignedInt
   attendance    attendance @relation(fields: [attendance_id], references: [id], onDelete: Cascade, onUpdate: NoAction)
-  projects      projects?  @relation(fields: [project_id], references: [id], onDelete: SetNull, onUpdate: NoAction)
+  projects      projects?  @relation(fields: [project_id], references: [id], onDelete: Cascade, onUpdate: NoAction)
 
   @@index([attendance_id], map: "idx_attendance_project_logs_aid")
   @@index([project_id], map: "idx_project_id")
@@ -197,6 +197,7 @@ model invoices {
   @@index([customer_id], map: "customer_id")
   @@index([due_date], map: "idx_invoices_due_date")
   @@index([status, issue_date], map: "idx_invoices_status_issue")
+  @@index([status, due_date], map: "idx_invoices_status_due")
   @@index([order_id], map: "order_id")
 }
 
@@ -582,6 +583,7 @@ model users {
   totp_secret                                      String?          @db.VarChar(255)
   totp_enabled                                     Boolean          @default(false)
   totp_backup_codes                                String?          @db.Text
+  totp_last_used_counter                           Int?
   attendance                                       attendance[]
   leave_balances                                   leave_balances[]
   leave_requests_leave_requests_user_idTousers     leave_requests[] @relation("leave_requests_user_idTousers")