fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/__tests__/ai.test.ts

@@ -65,15 +65,21 @@ describe("ai.service cost + budget", () => {
     expect(Number(rows[0].cost_usd)).toBeCloseTo(0.0195, 6);
   });
 
-  it("sums only the current month's spend", async () => {
+  it("sums only the current month's spend (excludes prior months)", async () => {
+    // Measure the baseline so the assertion is robust to any OTHER current-month
+    // rows that may already exist in the test DB (getMonthSpendUsd sums ALL
+    // kinds, not just ours). We assert the DELTA we introduce, not an absolute
+    // upper bound.
+    const before = await getMonthSpendUsd();
+
     await recordUsage({
       userId: null,
       kind: KIND,
       model: "claude-sonnet-4-6",
       inputTokens: 1_000_000,
       outputTokens: 0,
-    }); // $3 this month
-    // An old row (last year) must NOT count.
+    }); // +$3 this month
+    // An old row (year 2000) must NOT count toward the current month.
     await prisma.ai_usage.create({
       data: {
         kind: KIND,
@@ -84,9 +90,11 @@ describe("ai.service cost + budget", () => {
         created_at: new Date("2000-01-01T00:00:00Z"),
       },
     });
-    const spend = await getMonthSpendUsd();
-    expect(spend).toBeGreaterThanOrEqual(3);
-    expect(spend).toBeLessThan(6); // the year-2000 $3 is excluded
+
+    const after = await getMonthSpendUsd();
+    // Only the $3 current-month row moved the needle; the year-2000 $3 is
+    // excluded. The delta is exactly $3 (not $6).
+    expect(after - before).toBeCloseTo(3, 6);
   });
 
   it("assertBudgetAvailable blocks at/over budget, allows under", async () => {
@@ -94,7 +102,11 @@ describe("ai.service cost + budget", () => {
     // Under budget → null (allowed)
     expect(await assertBudgetAvailable()).toBeNull();
     // Push spend over budget for this month, then it must block with 402.
-    await prisma.ai_usage.create({
+    // Tag with a unique marker so we can delete EXACTLY this row at the end of
+    // the test — that keeps the inflated spend from leaking into any other
+    // current-month test regardless of execution order (the beforeEach kind=KIND
+    // cleanup would catch it too, but cleaning in-test makes it order-proof).
+    const overBudget = await prisma.ai_usage.create({
       data: {
         kind: KIND,
         model: "claude-sonnet-4-6",
@@ -104,9 +116,17 @@ describe("ai.service cost + budget", () => {
         created_at: new Date(),
       },
     });
-    const blocked = await assertBudgetAvailable();
-    expect(blocked).not.toBeNull();
-    expect(blocked?.status).toBe(402);
+    try {
+      const blocked = await assertBudgetAvailable();
+      expect(blocked).not.toBeNull();
+      expect(blocked?.status).toBe(402);
+    } finally {
+      // Remove the over-budget row immediately so it cannot inflate
+      // getMonthSpendUsd for any subsequently-running test.
+      await prisma.ai_usage
+        .delete({ where: { id: overBudget.id } })
+        .catch(() => {});
+    }
   });
 
   it("isConfigured reflects the API key presence", () => {