fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/admin/components/ShiftFormModal.tsx

@@ -1,3 +1,4 @@
+import { useRef } from "react";
 import Box from "@mui/material/Box";
 import Typography from "@mui/material/Typography";
 import IconButton from "@mui/material/IconButton";
@@ -17,8 +18,6 @@ import {
   formatDate,
 } from "../utils/attendanceHelpers";
 
-let _logKeyCounter = 0;
-
 // ---------- Shared types ----------
 
 export interface ShiftFormData {
@@ -226,6 +225,11 @@ export default function ShiftFormModal({
   const isCreate = mode === "create";
   const isWorkType = form.leave_type === "work";
 
+  // Per-instance counter for stable React keys on newly-added project rows.
+  // (Was a module-level mutable `let`, which is shared across every modal
+  // instance and fragile under StrictMode / concurrent instances.)
+  const logKeyCounter = useRef(0);
+
   const updateField = (field: keyof ShiftFormData, value: string | number) => {
     setForm({ ...form, [field]: value });
   };
@@ -244,7 +248,7 @@ export default function ShiftFormModal({
     setProjectLogs([
       ...projectLogs,
       {
-        _key: `log-${++_logKeyCounter}`,
+        _key: `log-${++logKeyCounter.current}`,
         project_id: "",
         hours: "",
         minutes: "",
@@ -327,7 +331,9 @@ export default function ShiftFormModal({
             inputMode="decimal"
             value={form.leave_hours}
             onChange={(e) =>
-              updateField("leave_hours", parseFloat(e.target.value))
+              // Empty input -> parseFloat returns NaN, which serializes to an
+              // invalid value; fall back to 0 like the Number(...)||0 pattern.
+              updateField("leave_hours", Number(e.target.value) || 0)
             }
             slotProps={{ htmlInput: { min: 0.5, max: 24, step: 0.5 } }}
           />
@@ -431,7 +437,10 @@ export default function ShiftFormModal({
           <ProjectTimeStatus form={form} projectLogs={projectLogs} />
           {projectLogs.map((log, i) => (
             <ProjectLogRow
-              key={log._key || i}
+              // Stable key: client-added rows carry `_key`; server-loaded rows
+              // carry a DB `id`. Fall back to the index only when neither is
+              // present (shouldn't happen, but avoids a key collision).
+              key={log._key ?? (log.id != null ? `id-${log.id}` : i)}
               log={log}
               index={i}
               projectList={projectList}