v1.8.0: warehouse module (16 commits), docházka mzda model, leave_type=holiday removal, api.ts race fix

Highlights:
- Warehouse module: receipts, issues, reservations, inventory, reports, dashboard,
  master data (categories, suppliers, locations), FIFO service, integration tests
- Docházka: mzda PDF counting model (Odpracováno / Vč. svátků / Přesčas / Svátek /
  So/Ne / Noc) with Czech weekday names and decimal hours
- AttendanceAdmin/AttendanceHistory KPI cards unified to mzda formula with
  fund bar colored by delta, badges for Práce/Dov/Nem/Sv/Nep
- Remove leave_type=holiday entirely (auto-computed from Czech public holidays)
- Allow multiple work shifts per day (overlap detection only)
- Pre-flight refresh in api.ts eliminates spurious 401s on fresh page loads
- Prisma: company_settings gets 6 nullable columns for warehouse numbering
  (PRI/VYD/INV prefixes, default patterns); migration seeds defaults

src/routes/admin/users.ts

@@ -103,16 +103,22 @@ export default async function usersRoutes(
       const parsed = parseBody(UpdateUserSchema, request.body);
       if ("error" in parsed) return error(reply, parsed.error, 400);
 
-      const userData = {
-        ...parsed.data,
-        role_id:
-          parsed.data.role_id != null
-            ? Number(parsed.data.role_id)
-            : (parsed.data.role_id as number | null | undefined),
-      };
+      // Privilege-escalation guard: role changes and activation toggles are
+      // admin-only. Any other `users.edit` holder (e.g. "manager") could
+      // otherwise reassign roles or disable other accounts.
+      const callerIsAdmin = request.authData?.roleName === "admin";
+      const userData: Record<string, unknown> = { ...parsed.data };
+      if (!callerIsAdmin) {
+        delete userData.role_id;
+        delete userData.is_active;
+      }
+      if (userData.role_id != null) {
+        userData.role_id = Number(userData.role_id);
+      }
+
       const result = await updateUser(
         id,
-        userData,
+        userData as Parameters<typeof updateUser>[1],
         request.authData?.roleName ?? undefined,
       );
       if ("error" in result) return error(reply, result.error!, result.status!);