v1.8.0: warehouse module (16 commits), docházka mzda model, leave_type=holiday removal, api.ts race fix

Highlights:
- Warehouse module: receipts, issues, reservations, inventory, reports, dashboard,
  master data (categories, suppliers, locations), FIFO service, integration tests
- Docházka: mzda PDF counting model (Odpracováno / Vč. svátků / Přesčas / Svátek /
  So/Ne / Noc) with Czech weekday names and decimal hours
- AttendanceAdmin/AttendanceHistory KPI cards unified to mzda formula with
  fund bar colored by delta, badges for Práce/Dov/Nem/Sv/Nep
- Remove leave_type=holiday entirely (auto-computed from Czech public holidays)
- Allow multiple work shifts per day (overlap detection only)
- Pre-flight refresh in api.ts eliminates spurious 401s on fresh page loads
- Prisma: company_settings gets 6 nullable columns for warehouse numbering
  (PRI/VYD/INV prefixes, default patterns); migration seeds defaults

src/services/leave-notification.ts

@@ -26,6 +26,18 @@ function escapeHtml(str: string): string {
     .replace(/"/g, """);
 }
 
+// Strip characters that could break out of the email Subject: header
+// (CRLF, NUL) or otherwise pollute the envelope. Without this, a user
+// can set their first_name to "attacker\nBcc: victim@x.com" via the
+// profile editor and pivot into sending mail as noreply@boha.cz.
+function sanitizeHeaderValue(str: string): string {
+  // eslint-disable-next-line no-control-regex
+  return str
+    .replace(/[\r\n\t\0]/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+}
+
 interface LeaveRequestData {
   leave_type: string;
   date_from: string;
@@ -48,7 +60,7 @@ export async function notifyNewLeaveRequest(
   const dateTo = formatDate(request.date_to);
   const notes = request.notes || "";
 
-  const subject = `Nová žádost o nepřítomnost - ${employeeName} (${leaveType})`;
+  const subject = `Nová žádost o nepřítomnost - ${sanitizeHeaderValue(employeeName)} (${sanitizeHeaderValue(leaveType)})`;
 
   const appUrl = config.appUrl || "";
   const approvalLink = appUrl