fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/admin/pages/WarehouseIssueForm.tsx

@@ -264,6 +264,28 @@ export default function WarehouseIssueForm() {
     }
   }, [isEdit, issue]);
 
+  const saveMutation = useApiMutation<
+    ReturnType<typeof buildPayload>,
+    { id?: number }
+  >({
+    url: () =>
+      isEdit
+        ? `/api/admin/warehouse/issues/${id}`
+        : "/api/admin/warehouse/issues",
+    method: () => (isEdit ? "PUT" : "POST"),
+    invalidate: ["warehouse"],
+  });
+
+  const confirmMutation = useApiMutation<number, void>({
+    url: (issueId) => `/api/admin/warehouse/issues/${issueId}/confirm`,
+    method: () => "POST",
+    invalidate: ["warehouse"],
+    onSuccess: () => {
+      alert.success("Výdejka byla potvrzena");
+    },
+  });
+
+  // All hooks above this line — permission gate is the last thing before render.
   if (!hasPermission("warehouse.operate")) return <Forbidden />;
 
   const addItem = () => {
@@ -332,31 +354,6 @@ export default function WarehouseIssueForm() {
       })),
   });
 
-  const saveMutation = useApiMutation<
-    ReturnType<typeof buildPayload>,
-    { id?: number }
-  >({
-    url: () =>
-      isEdit
-        ? `/api/admin/warehouse/issues/${id}`
-        : "/api/admin/warehouse/issues",
-    method: () => (isEdit ? "PUT" : "POST"),
-    invalidate: ["warehouse"],
-  });
-
-  const [confirmIssueId, setConfirmIssueId] = useState<number | null>(null);
-  const confirmMutation = useApiMutation<void, void>({
-    url: () =>
-      confirmIssueId
-        ? `/api/admin/warehouse/issues/${confirmIssueId}/confirm`
-        : "/api/admin/warehouse/issues/0/confirm",
-    method: () => "POST",
-    invalidate: ["warehouse"],
-    onSuccess: () => {
-      alert.success("Výdejka byla potvrzena");
-    },
-  });
-
   const saveIssue = async (): Promise<number | null> => {
     try {
       const data = await saveMutation.mutateAsync(buildPayload());
@@ -370,13 +367,10 @@ export default function WarehouseIssueForm() {
   };
 
   const confirmIssue = async (issueId: number) => {
-    setConfirmIssueId(issueId);
     try {
-      await confirmMutation.mutateAsync(undefined);
+      await confirmMutation.mutateAsync(issueId);
     } catch (e) {
       alert.error(e instanceof Error ? e.message : "Chyba připojení");
-    } finally {
-      setConfirmIssueId(null);
     }
   };