security: fix all Medium findings from FLAWS_REPORT audit

- Auth: TOTP replay protection with counter tracking, constant-time
  backup code comparison, atomic lockout increment, per-token logout
- Invoices/PDFs: net-based VAT calculation, dangerous URL scheme
  stripping in cleanQuillHtml, orders-pdf error handling
- Orders: reject item changes on status transition, cascading
  delete cleanup, take:1 with orderBy
- Projects: atomic rename collision handling, MIME/extension
  validation, empty customer name rejection
- Attendance: Czech public holiday awareness in frontend fund
  calculation, leave_hours 0 handling, invalid date NaN guard,
  bounded per-month queries in workfund
- Users/Admin: profile audit logging + password validation, session
  revocation guard, session ID validation, dashboard DB aggregation,
  soft-deleted record protection in scope templates
- Frontend: FormField label linkage, Pagination ARIA, error
  handling in OrderConfirmationModal, 401 propagation, GPS emoji
  hidden from screen readers, table sort state fix, geolocation
  race/abort cleanup, Leaflet popup DOM safety, Vehicles toggleActive
  minimal body, CompanySettings ref mutation fix, OfferDetail unlock
  abort, AttendanceBalances combined fetches
- Utils: env validation, Puppeteer concurrency mutex, invoice alert
  cron cleanup on shutdown, body limit alignment, TOTP error logging,
  trustProxy from env, symlink rejection, rate cache Map usage

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/admin/components/AttendanceShiftTable.tsx

@@ -1,4 +1,4 @@
-import { Link } from "react-router-dom";
+import { Link } from "react-router-dom";
 import {
   formatDate,
   formatDatetime,
@@ -64,20 +64,26 @@ function renderProjectCell(record: AttendanceRecord): React.ReactNode {
           let h: number,
             m: number,
             isActive = false;
+          let durationValid = true;
           if (log.hours !== null && log.hours !== undefined) {
             h = parseInt(String(log.hours)) || 0;
             m = parseInt(String(log.minutes)) || 0;
           } else {
             isActive = !log.ended_at;
             const end = log.ended_at ? new Date(log.ended_at) : new Date();
-            const mins = Math.max(
-              0,
-              Math.floor(
-                (end.getTime() - new Date(log.started_at!).getTime()) / 60000,
-              ),
-            );
-            h = Math.floor(mins / 60);
-            m = mins % 60;
+            const start = log.started_at ? new Date(log.started_at) : null;
+            if (start && !isNaN(start.getTime()) && !isNaN(end.getTime())) {
+              const mins = Math.max(
+                0,
+                Math.floor((end.getTime() - start.getTime()) / 60000),
+              );
+              h = Math.floor(mins / 60);
+              m = mins % 60;
+            } else {
+              durationValid = false;
+              h = 0;
+              m = 0;
+            }
           }
           return (
             <span
@@ -89,8 +95,7 @@ function renderProjectCell(record: AttendanceRecord): React.ReactNode {
                 background: isActive ? "var(--accent-light)" : undefined,
               }}
             >
-              {log.project_name || `#${log.project_id}`} ({h}:
-              {String(m).padStart(2, "0")}h{isActive ? " \u25B8" : ""})
+              {log.project_name || `#${log.project_id}`} {durationValid ? `(${h}:${String(m).padStart(2, "0")}h${isActive ? " \u25B8" : ""})` : "—"}
             </span>
           );
         })}
@@ -118,7 +123,7 @@ export default function AttendanceShiftTable({
   if (records.length === 0) {
     return (
       <div className="admin-empty-state">
-        <p>Za tento měsíc nejsou žádné záznamy.</p>
+        <p>Za tento měsíc nejsou žádné záznamy.</p>
       </div>
     );
   }
@@ -129,15 +134,15 @@ export default function AttendanceShiftTable({
         <thead>
           <tr>
             <th>Datum</th>
-            <th>Zaměstnanec</th>
+            <th>Zaměstnanec</th>
             <th>Typ</th>
-            <th>Příchod</th>
+            <th>Příchod</th>
             <th>Pauza</th>
             <th>Odchod</th>
             <th>Hodiny</th>
             <th>Projekt</th>
             <th>GPS</th>
-            <th>Poznámka</th>
+            <th>Poznámka</th>
             <th>Akce</th>
           </tr>
         </thead>
@@ -146,7 +151,8 @@ export default function AttendanceShiftTable({
             const leaveType = record.leave_type || "work";
             const isLeave = leaveType !== "work";
             const workMinutes = isLeave
-              ? (Number(record.leave_hours) || 8) * 60
+              ? (record.leave_hours != null ? Number(record.leave_hours) : 8) *
+                60
               : calculateWorkMinutes(record);
             const hasLocation =
               (record.arrival_lat && record.arrival_lng) ||
@@ -186,7 +192,7 @@ export default function AttendanceShiftTable({
                       title="Zobrazit polohu"
                       aria-label="Zobrazit polohu"
                     >
-                      {"\uD83D\uDCCD"}
+                      <span aria-hidden="true">{"\uD83D\uDCCD"}</span>
                     </Link>
                   ) : (
                     "\u2014"
@@ -251,3 +257,4 @@ export default function AttendanceShiftTable({
     </div>
   );
 }
+