fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/admin/components/dashboard/DashProfile.tsx

@@ -1,5 +1,6 @@
 import { useState, useRef } from "react";
-import { motion } from "framer-motion";
+import { motion, useReducedMotion } from "framer-motion";
+import { useQueryClient } from "@tanstack/react-query";
 import Box from "@mui/material/Box";
 import Typography from "@mui/material/Typography";
 import IconButton from "@mui/material/IconButton";
@@ -125,6 +126,8 @@ export default function DashProfile({
 }: DashProfileProps) {
   const { user, updateUser } = useAuth();
   const alert = useAlert();
+  const queryClient = useQueryClient();
+  const reduce = useReducedMotion();
   const totpSetupRef = useRef<HTMLInputElement>(null);
 
   // The 2FA setup dialog is bespoke (multi-step: setup → backup codes) and
@@ -156,21 +159,30 @@ export default function DashProfile({
 
   const handleSubmit = async (e?: React.FormEvent) => {
     e?.preventDefault();
-    const dataToSave = { ...formData };
 
-    if (dataToSave.new_password && !dataToSave.current_password) {
+    if (formData.new_password && !formData.current_password) {
       alert.error("Pro změnu hesla zadejte aktuální heslo");
       return;
     }
-    if (dataToSave.current_password && !dataToSave.new_password) {
+    if (formData.current_password && !formData.new_password) {
       alert.error("Pro změnu hesla zadejte nové heslo");
       return;
     }
 
-    // Strip empty password fields so Zod doesn't reject ""
-    if (!dataToSave.current_password)
-      delete (dataToSave as any).current_password;
-    if (!dataToSave.new_password) delete (dataToSave as any).new_password;
+    // Build the payload with the password fields optional so empty ones can be
+    // omitted (Zod rejects ""), without resorting to `as any` deletes.
+    const dataToSave: Partial<
+      Pick<ProfileFormData, "current_password" | "new_password">
+    > &
+      Omit<ProfileFormData, "current_password" | "new_password"> = {
+      username: formData.username,
+      email: formData.email,
+      first_name: formData.first_name,
+      last_name: formData.last_name,
+    };
+    if (formData.current_password)
+      dataToSave.current_password = formData.current_password;
+    if (formData.new_password) dataToSave.new_password = formData.new_password;
 
     try {
       const response = await apiFetch(`${API_BASE}/profile`, {
@@ -185,13 +197,21 @@ export default function DashProfile({
           email: dataToSave.email,
           fullName: `${dataToSave.first_name} ${dataToSave.last_name}`.trim(),
         });
+        // Refresh anything keyed on the current user's data so stale views
+        // (dashboard widgets, user lists) pick up the edited profile.
+        queryClient.invalidateQueries({ queryKey: ["dashboard"] });
+        queryClient.invalidateQueries({ queryKey: ["users"] });
         setShowModal(false);
+        // The 300ms wait is load-bearing: it lets the modal's close fade finish
+        // before the success toast appears, so the toast doesn't flash over the
+        // still-fading dialog.
         await new Promise((resolve) => setTimeout(resolve, 300));
         alert.success("Profil byl upraven");
       } else {
         alert.error(data.error || "Nepodařilo se uložit profil");
       }
-    } catch {
+    } catch (err) {
+      console.error("DashProfile: uložení profilu selhalo", err);
       alert.error("Chyba připojení");
     }
   };
@@ -216,8 +236,8 @@ export default function DashProfile({
   return (
     <>
       <motion.div
-        initial={{ opacity: 0, y: 12 }}
-        animate={{ opacity: 1, y: 0 }}
+        initial={reduce ? false : { opacity: 0, y: 12 }}
+        animate={reduce ? undefined : { opacity: 1, y: 0 }}
         transition={{ duration: 0.25, delay: 0.15 }}
       >
         <Card>