fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/admin/pages/WarehouseSuppliers.tsx

@@ -129,10 +129,6 @@ export default function WarehouseSuppliers() {
     show: boolean;
     supplier: WarehouseSupplier | null;
   }>({ show: false, supplier: null });
-  const [saving, setSaving] = useState(false);
-  const [toggleActiveSupplierId, setToggleActiveSupplierId] = useState<
-    number | null
-  >(null);
 
   const submitMutation = useApiMutation<
     SupplierForm,
@@ -158,14 +154,14 @@ export default function WarehouseSuppliers() {
     },
   });
 
+  // id is captured from the mutation variable (built into the URL), so it stays
+  // correct even when called immediately after a state update. The non-strict
+  // UpdateSupplierSchema strips the `id` field from the body.
   const toggleActiveMutation = useApiMutation<
-    { is_active: boolean },
+    { id: number; is_active: boolean },
     { message?: string }
   >({
-    url: () => {
-      if (!toggleActiveSupplierId) return API_BASE;
-      return `${API_BASE}/${toggleActiveSupplierId}`;
-    },
+    url: ({ id }) => `${API_BASE}/${id}`,
     method: () => "PUT",
     invalidate: ["warehouse"],
   });
@@ -210,13 +206,10 @@ export default function WarehouseSuppliers() {
     setErrors(newErrors);
     if (Object.keys(newErrors).length > 0) return;
 
-    setSaving(true);
     try {
       await submitMutation.mutateAsync(form);
     } catch (e) {
       alert.error(e instanceof Error ? e.message : "Chyba připojení");
-    } finally {
-      setSaving(false);
     }
   };
 
@@ -231,9 +224,9 @@ export default function WarehouseSuppliers() {
   };
 
   const toggleActive = async (supplier: WarehouseSupplier) => {
-    setToggleActiveSupplierId(supplier.id);
     try {
       await toggleActiveMutation.mutateAsync({
+        id: supplier.id,
         is_active: !supplier.is_active,
       });
       alert.success(
@@ -243,8 +236,6 @@ export default function WarehouseSuppliers() {
       );
     } catch (e) {
       alert.error(e instanceof Error ? e.message : "Chyba připojení");
-    } finally {
-      setToggleActiveSupplierId(null);
     }
   };
 
@@ -403,7 +394,7 @@ export default function WarehouseSuppliers() {
         onClose={() => setShowModal(false)}
         onSubmit={handleSubmit}
         title={editingSupplier ? "Upravit dodavatele" : "Přidat dodavatele"}
-        loading={saving}
+        loading={submitMutation.isPending}
       >
         <Field label="Název" required error={errors.name}>
           <TextField