fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/admin/components/PlanGrid.tsx

@@ -466,9 +466,23 @@ export default function PlanGrid({
 }: Props) {
   const today = useMemo(() => todayIso(), []);
   const catMap = useMemo(() => categoryMap(categories), [categories]);
+  // Index projects by id once per projects change instead of a linear
+  // projects.find() inside the per-cell render loop (which was
+  // O(days * users * cells * projects)). Hooks must run before the early
+  // return below, so this is computed unconditionally.
+  const projectMap = useMemo(() => {
+    const m = new Map<number, Project>();
+    for (const p of projects) m.set(p.id, p);
+    return m;
+  }, [projects]);
+  // Memoize the day list so it isn't rebuilt on every render (only when the
+  // visible range changes). Stable identity also keeps the row map cheap.
+  const days = useMemo(
+    () => (data ? eachDay(data.date_from, data.date_to) : []),
+    [data?.date_from, data?.date_to],
+  );
 
   if (!data) return <LoadingState />;
-  const days = eachDay(data.date_from, data.date_to);
   const users = data.users;
   // pulseKey?.nonce is included in the data-pulse attribute so a second
   // mutation on the same cell re-triggers the animation (CSS animations
@@ -610,12 +624,9 @@ export default function PlanGrid({
                               cell={c}
                               project={
                                 c.project_id
-                                  ? (projects.find(
-                                      (p) => p.id === c.project_id,
-                                    ) ?? null)
+                                  ? (projectMap.get(c.project_id) ?? null)
                                   : null
                               }
-                              readonly={!canEdit}
                               categoryLabel={planCategoryLabel(
                                 c.category,
                                 catMap,