v1.8.0: warehouse module (16 commits), docházka mzda model, leave_type=holiday removal, api.ts race fix

Highlights:
- Warehouse module: receipts, issues, reservations, inventory, reports, dashboard,
  master data (categories, suppliers, locations), FIFO service, integration tests
- Docházka: mzda PDF counting model (Odpracováno / Vč. svátků / Přesčas / Svátek /
  So/Ne / Noc) with Czech weekday names and decimal hours
- AttendanceAdmin/AttendanceHistory KPI cards unified to mzda formula with
  fund bar colored by delta, badges for Práce/Dov/Nem/Sv/Nep
- Remove leave_type=holiday entirely (auto-computed from Czech public holidays)
- Allow multiple work shifts per day (overlap detection only)
- Pre-flight refresh in api.ts eliminates spurious 401s on fresh page loads
- Prisma: company_settings gets 6 nullable columns for warehouse numbering
  (PRI/VYD/INV prefixes, default patterns); migration seeds defaults

src/routes/admin/received-invoices.ts

@@ -1,6 +1,7 @@
 import { FastifyInstance } from "fastify";
 import multipart from "@fastify/multipart";
 import { received_invoices_status } from "@prisma/client";
+import { z } from "zod";
 import prisma from "../../config/database";
 import { requirePermission } from "../../middleware/auth";
 import { logAudit } from "../../services/audit";
@@ -246,9 +247,26 @@ export default async function receivedInvoicesRoutes(
             });
           } else if (part.fieldname === "invoices") {
             try {
-              invoicesMeta = JSON.parse(part.value as string);
+              const parsed: unknown = JSON.parse(part.value as string);
+              // The frontend sends a partial payload (one element per uploaded
+              // file, only the editable fields). Validate each entry against a
+              // permissive variant of the create schema so untyped keys (NaN,
+              // huge numbers, weird date strings) can't reach the
+              // calculations below.
+              const arrSchema = z.array(CreateReceivedInvoiceSchema.partial());
+              const validated = arrSchema.safeParse(parsed);
+              if (validated.success) {
+                invoicesMeta = validated.data as Array<Record<string, unknown>>;
+              } else {
+                return error(
+                  reply,
+                  "Neplatná metadata faktur: " +
+                    validated.error.issues.map((i) => i.message).join(", "),
+                  400,
+                );
+              }
             } catch {
-              // Malformed invoices metadata — ignore, use defaults
+              return error(reply, "Neplatný JSON v poli 'invoices'", 400);
             }
           }
         }