fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/admin/components/warehouse/ReservationPicker.tsx

@@ -1,3 +1,4 @@
+import { useEffect } from "react";
 import { useQuery } from "@tanstack/react-query";
 import MenuItem from "@mui/material/MenuItem";
 import { Select } from "../../ui";
@@ -16,7 +17,7 @@ export default function ReservationPicker({
   value,
   onChange,
 }: ReservationPickerProps) {
-  const { data: result } = useQuery(
+  const { data: result, isFetching } = useQuery(
     warehouseReservationListOptions({
       item_id: itemId ?? undefined,
       project_id: projectId ?? undefined,
@@ -27,6 +28,22 @@ export default function ReservationPicker({
 
   const reservations = result?.data ?? [];
 
+  // When item/project change, the loaded reservation list changes. If the
+  // currently-selected reservation is no longer available, clear it and notify
+  // the parent so it doesn't keep holding a stale reservationId. Only act once
+  // the query has settled (result present, not fetching) to avoid resetting
+  // while the new list is still loading.
+  useEffect(() => {
+    if (
+      value != null &&
+      result !== undefined &&
+      !isFetching &&
+      !reservations.some((r) => r.id === value)
+    ) {
+      onChange(null, 0);
+    }
+  }, [value, result, isFetching, reservations, onChange]);
+
   return (
     <Select
       value={value == null ? "" : String(value)}
@@ -38,7 +55,7 @@ export default function ReservationPicker({
         const reservationId = Number(val);
         const reservation = reservations.find((r) => r.id === reservationId);
         if (reservation) {
-          onChange(reservationId, Number(reservation.remaining_qty));
+          onChange(reservationId, reservation.remaining_qty);
         }
       }}
     >
@@ -46,7 +63,7 @@ export default function ReservationPicker({
       {reservations.map((r) => (
         <MenuItem key={r.id} value={String(r.id)}>
           R{r.id} — {r.project?.name ?? `Projekt #${r.project_id}`} — zbývá:{" "}
-          {Number(r.remaining_qty)} {r.item?.unit ?? "ks"}
+          {r.remaining_qty} {r.item?.unit ?? "ks"}
         </MenuItem>
       ))}
     </Select>