v1.8.0: warehouse module (16 commits), docházka mzda model, leave_type=holiday removal, api.ts race fix

Highlights:
- Warehouse module: receipts, issues, reservations, inventory, reports, dashboard,
  master data (categories, suppliers, locations), FIFO service, integration tests
- Docházka: mzda PDF counting model (Odpracováno / Vč. svátků / Přesčas / Svátek /
  So/Ne / Noc) with Czech weekday names and decimal hours
- AttendanceAdmin/AttendanceHistory KPI cards unified to mzda formula with
  fund bar colored by delta, badges for Práce/Dov/Nem/Sv/Nep
- Remove leave_type=holiday entirely (auto-computed from Czech public holidays)
- Allow multiple work shifts per day (overlap detection only)
- Pre-flight refresh in api.ts eliminates spurious 401s on fresh page loads
- Prisma: company_settings gets 6 nullable columns for warehouse numbering
  (PRI/VYD/INV prefixes, default patterns); migration seeds defaults

src/schemas/auth.schema.ts

@@ -14,7 +14,12 @@ export const TotpVerifySchema = z.object({
 
 export const TotpBackupSchema = z.object({
   login_token: z.string().min(1, "Token je povinný"),
-  backup_code: z.string().min(1, "Záložní kód je povinný"),
+  backup_code: z
+    .string()
+    .min(1, "Záložní kód je povinný")
+    // Cap length so a request with bodyLimit=10KB can't trigger N×bcrypt on
+    // a multi-KB string. Real backup codes are 8-16 chars; 64 is generous.
+    .max(64, "Záložní kód je příliš dlouhý"),
 });
 
 export const TotpEnableSchema = z.object({