security: fix all Critical and High findings from FLAWS_REPORT audit

- Auth: pessimistic locking on login tokens and refresh token rotation,
  backup code attempt counter, rate limiting verification
- Schema: unique constraints on business numbers, FK relations,
  unsigned/signed alignment, attendance duplicate prevention
- Invoices/PDFs: DOMPurify sanitization, bounded queries in stats
  and alerts, VAT rounding, Puppeteer error handling
- Orders/Offers: transactional parent+child creation, Zod NaN
  refinement, status enums, uniqueness checks
- Projects/Files: path traversal protection, streamed uploads,
  permission guards, query param validation
- Attendance/HR: duplicate checks, ownership validation, GPS
  restrictions, trip distance validation
- Frontend: modal lock reference counting, XSS escaping in print
  HTML, ref mutation fixes, accessibility attributes

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/admin/components/AdminDatePicker.tsx

@@ -91,7 +91,7 @@ function NativeInput({
 }
 
 interface AdminDatePickerProps {
-  mode?: "date" | "month" | "datetime" | "time";
+  mode?: "date" | "month" | "time";
   value: string;
   onChange: (value: string) => void;
   minDate?: string;

src/admin/components/BulkAttendanceModal.tsx

@@ -57,13 +57,21 @@ export default function BulkAttendanceModal({
           />
           <motion.div
             className="admin-modal admin-modal-lg"
+            role="dialog"
+            aria-modal="true"
+            aria-labelledby="bulk-attendance-modal-title"
             initial={{ opacity: 0, scale: 0.95, y: 20 }}
             animate={{ opacity: 1, scale: 1, y: 0 }}
             exit={{ opacity: 0, scale: 0.95, y: 20 }}
             transition={{ duration: 0.2 }}
           >
             <div className="admin-modal-header">
-              <h2 className="admin-modal-title">Vyplnit docházku za měsíc</h2>
+              <h2
+                id="bulk-attendance-modal-title"
+                className="admin-modal-title"
+              >
+                Vyplnit docházku za měsíc
+              </h2>
               <p
                 style={{
                   color: "var(--text-secondary)",

src/admin/components/ConfirmModal.tsx

@@ -39,6 +39,9 @@ export default function ConfirmModal({
           <div className="admin-modal-backdrop" onClick={onClose} />
           <motion.div
             className="admin-modal admin-confirm-modal"
+            role="dialog"
+            aria-modal="true"
+            aria-labelledby="confirm-modal-title"
             initial={{ opacity: 0, scale: 0.95, y: 20 }}
             animate={{ opacity: 1, scale: 1, y: 0 }}
             exit={{ opacity: 0, scale: 0.95, y: 20 }}
@@ -59,7 +62,9 @@ export default function ConfirmModal({
                   <line x1="12" y1="17" x2="12.01" y2="17" />
                 </svg>
               </div>
-              <h2 className="admin-confirm-title">{title}</h2>
+              <h2 id="confirm-modal-title" className="admin-confirm-title">
+                {title}
+              </h2>
               <p className="admin-confirm-message">{message}</p>
             </div>
             <div className="admin-modal-footer">

src/admin/components/OrderConfirmationModal.tsx

@@ -109,13 +109,19 @@ export default function OrderConfirmationModal({
             className={
               step === "edit" ? "admin-modal admin-modal-lg" : "admin-modal"
             }
+            role="dialog"
+            aria-modal="true"
+            aria-labelledby="order-confirmation-modal-title"
             initial={{ opacity: 0, scale: 0.95, y: 20 }}
             animate={{ opacity: 1, scale: 1, y: 0 }}
             exit={{ opacity: 0, scale: 0.95, y: 20 }}
             transition={{ duration: 0.2 }}
           >
             <div className="admin-modal-header">
-              <h2 className="admin-modal-title">
+              <h2
+                id="order-confirmation-modal-title"
+                className="admin-modal-title"
+              >
                 Potvrzení objednávky {orderNumber}
               </h2>
             </div>

src/admin/components/ProjectFileManager.tsx

@@ -197,6 +197,7 @@ export default function ProjectFileManager({
 }: ProjectFileManagerProps) {
   const alert = useAlert();
   const fileInputRef = useRef<HTMLInputElement>(null);
+  const isCancelling = useRef(false);
 
   const [items, setItems] = useState<FileItem[]>([]);
   const [loading, setLoading] = useState(true);
@@ -768,10 +769,26 @@ export default function ProjectFileManager({
                             }}
                             autoFocus
                             onKeyDown={(e) => {
-                              if (e.key === "Enter") handleRename(item);
-                              if (e.key === "Escape") setRenamingItem(null);
+                              if (e.key === "Enter") {
+                                e.preventDefault();
+                                handleRename(item);
+                              }
+                              if (e.key === "Escape") {
+                                e.preventDefault();
+                                isCancelling.current = true;
+                                setRenamingItem(null);
+                                setRenameValue(item.name);
+                                setTimeout(() => {
+                                  isCancelling.current = false;
+                                }, 0);
+                              }
+                            }}
+                            onBlur={() => {
+                              if (isCancelling.current) {
+                                return;
+                              }
+                              handleRename(item);
                             }}
-                            onBlur={() => handleRename(item)}
                           />
                         ) : (
                           <FileNameCell

src/admin/components/ShiftFormModal.tsx

@@ -251,13 +251,16 @@ export default function ShiftFormModal({
           <div className="admin-modal-backdrop" onClick={onClose} />
           <motion.div
             className="admin-modal admin-modal-lg"
+            role="dialog"
+            aria-modal="true"
+            aria-labelledby="shift-form-modal-title"
             initial={{ opacity: 0, scale: 0.95, y: 20 }}
             animate={{ opacity: 1, scale: 1, y: 0 }}
             exit={{ opacity: 0, scale: 0.95, y: 20 }}
             transition={{ duration: 0.2 }}
           >
             <div className="admin-modal-header">
-              <h2 className="admin-modal-title">
+              <h2 id="shift-form-modal-title" className="admin-modal-title">
                 {isCreate ? "Přidat záznam docházky" : "Upravit docházku"}
               </h2>
               {!isCreate && editingRecord && (