security: fix all Medium findings from FLAWS_REPORT audit

- Auth: TOTP replay protection with counter tracking, constant-time
  backup code comparison, atomic lockout increment, per-token logout
- Invoices/PDFs: net-based VAT calculation, dangerous URL scheme
  stripping in cleanQuillHtml, orders-pdf error handling
- Orders: reject item changes on status transition, cascading
  delete cleanup, take:1 with orderBy
- Projects: atomic rename collision handling, MIME/extension
  validation, empty customer name rejection
- Attendance: Czech public holiday awareness in frontend fund
  calculation, leave_hours 0 handling, invalid date NaN guard,
  bounded per-month queries in workfund
- Users/Admin: profile audit logging + password validation, session
  revocation guard, session ID validation, dashboard DB aggregation,
  soft-deleted record protection in scope templates
- Frontend: FormField label linkage, Pagination ARIA, error
  handling in OrderConfirmationModal, 401 propagation, GPS emoji
  hidden from screen readers, table sort state fix, geolocation
  race/abort cleanup, Leaflet popup DOM safety, Vehicles toggleActive
  minimal body, CompanySettings ref mutation fix, OfferDetail unlock
  abort, AttendanceBalances combined fetches
- Utils: env validation, Puppeteer concurrency mutex, invoice alert
  cron cleanup on shutdown, body limit alignment, TOTP error logging,
  trustProxy from env, symlink rejection, rate cache Map usage

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/services/attendance.service.ts

@@ -517,12 +517,6 @@ export async function getWorkfund(year: number) {
     };
   }
 
-  const yearStart = new Date(year, 0, 1);
-  const yearEnd = new Date(year, maxMonth + 1, 0, 23, 59, 59);
-  const allRecords = await prisma.attendance.findMany({
-    where: { shift_date: { gte: yearStart, lte: yearEnd } },
-  });
-
   const months: Record<
     string,
     {
@@ -553,6 +547,19 @@ export async function getWorkfund(year: number) {
     const fundToDate = bizDaysToDate * 8;
     const monthStart = new Date(year, m, 1);
     const monthEnd = new Date(year, m + 1, 0, 23, 59, 59);
+    const monthRecords = await prisma.attendance.findMany({
+      where: { shift_date: { gte: monthStart, lte: monthEnd } },
+      select: {
+        user_id: true,
+        shift_date: true,
+        leave_type: true,
+        arrival_time: true,
+        departure_time: true,
+        break_start: true,
+        break_end: true,
+        leave_hours: true,
+      },
+    });
 
     const monthUsers: Record<
       string,
@@ -566,12 +573,7 @@ export async function getWorkfund(year: number) {
     > = {};
 
     for (const u of users) {
-      const recs = allRecords.filter(
-        (r) =>
-          r.user_id === u.id &&
-          r.shift_date >= monthStart &&
-          r.shift_date <= monthEnd,
-      );
+      const recs = monthRecords.filter((r) => r.user_id === u.id);
       let worked = 0;
       let vacationHours = 0;
       let sickHours = 0;