fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/admin/pages/Vehicles.tsx

@@ -2,7 +2,6 @@ import { useState } from "react";
 import { useQuery } from "@tanstack/react-query";
 import Box from "@mui/material/Box";
 import Typography from "@mui/material/Typography";
-import Chip from "@mui/material/Chip";
 import IconButton from "@mui/material/IconButton";
 import { useAlert } from "../context/AlertContext";
 import { useAuth } from "../context/AuthContext";
@@ -19,6 +18,7 @@ import {
   Field,
   TextField,
   SwitchField,
+  StatusChip,
   LoadingState,
   PageEnter,
   type DataColumn,
@@ -261,12 +261,10 @@ export default function Vehicles() {
       key: "status",
       header: "Stav",
       render: (v) => (
-        <Chip
+        <StatusChip
           label={v.is_active ? "Aktivní" : "Neaktivní"}
-          size="small"
           color={v.is_active ? "success" : "default"}
           onClick={() => toggleActive(v)}
-          sx={{ cursor: "pointer", fontWeight: 600 }}
         />
       ),
     },
@@ -401,7 +399,10 @@ export default function Vehicles() {
             value={form.initial_km}
             slotProps={{ htmlInput: { min: 0, inputMode: "numeric" } }}
             onChange={(e) =>
-              setForm({ ...form, initial_km: parseInt(e.target.value) || 0 })
+              setForm({
+                ...form,
+                initial_km: parseInt(e.target.value, 10) || 0,
+              })
             }
           />
         </Field>