fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/admin/pages/Attendance.tsx

@@ -300,7 +300,7 @@ export default function Attendance() {
   >({
     url: () => `${API_BASE}/leave-requests`,
     method: () => "POST",
-    invalidate: ["attendance", "leave-requests", "users"],
+    invalidate: ["attendance", "leave-requests", "leave", "users"],
   });
 
   const [submitting, setSubmitting] = useState(false);
@@ -323,6 +323,10 @@ export default function Attendance() {
   const mountedRef = useRef(true);
   const latestActionRef = useRef<string | null>(null);
 
+  // Live wall-clock display (HH:MM) — re-render every 30s so the shown time
+  // actually advances instead of freezing at first paint.
+  const [now, setNow] = useState(() => new Date());
+
   useEffect(() => {
     mountedRef.current = true;
     return () => {
@@ -332,6 +336,11 @@ export default function Attendance() {
     };
   }, []);
 
+  useEffect(() => {
+    const id = setInterval(() => setNow(new Date()), 30_000);
+    return () => clearInterval(id);
+  }, []);
+
   // Sync notes from query data when the shift changes
   useEffect(() => {
     if (statusQuery.data) {
@@ -475,10 +484,20 @@ export default function Attendance() {
     }
   };
 
+  // Parse a YYYY-MM-DD string into a LOCAL-midnight Date. `new Date("YYYY-MM-DD")`
+  // would parse as UTC midnight; reading it back with local getDay()/getDate()
+  // can land on the wrong calendar day in the evening Prague window.
+  const parseLocalDate = (s: string): Date | null => {
+    const m = /^(\d{4})-(\d{2})-(\d{2})/.exec(s);
+    if (!m) return null;
+    return new Date(Number(m[1]), Number(m[2]) - 1, Number(m[3]));
+  };
+
   const calculateBusinessDays = (from: string, to: string) => {
     if (!from || !to) return 0;
-    const start = new Date(from);
-    const end = new Date(to);
+    const start = parseLocalDate(from);
+    const end = parseLocalDate(to);
+    if (!start || !end) return 0;
     if (end < start) return 0;
     let days = 0;
     const current = new Date(start);
@@ -673,7 +692,7 @@ export default function Attendance() {
                   lineHeight: 1,
                 }}
               >
-                {new Date().toLocaleTimeString("cs-CZ", {
+                {now.toLocaleTimeString("cs-CZ", {
                   hour: "2-digit",
                   minute: "2-digit",
                 })}