security: fix all Critical and High findings from FLAWS_REPORT audit

- Auth: pessimistic locking on login tokens and refresh token rotation,
  backup code attempt counter, rate limiting verification
- Schema: unique constraints on business numbers, FK relations,
  unsigned/signed alignment, attendance duplicate prevention
- Invoices/PDFs: DOMPurify sanitization, bounded queries in stats
  and alerts, VAT rounding, Puppeteer error handling
- Orders/Offers: transactional parent+child creation, Zod NaN
  refinement, status enums, uniqueness checks
- Projects/Files: path traversal protection, streamed uploads,
  permission guards, query param validation
- Attendance/HR: duplicate checks, ownership validation, GPS
  restrictions, trip distance validation
- Frontend: modal lock reference counting, XSS escaping in print
  HTML, ref mutation fixes, accessibility attributes

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/admin/audit-log.ts

@@ -1,6 +1,7 @@
 import { FastifyInstance } from "fastify";
 import prisma from "../../config/database";
 import { requirePermission } from "../../middleware/auth";
+import { logAudit } from "../../services/audit";
 import { success, paginated, error } from "../../utils/response";
 import { parsePagination, buildPaginationMeta } from "../../utils/pagination";
 
@@ -53,6 +54,13 @@ export default async function auditLogRoutes(
       // days === 0 means "delete all" (from frontend "Vše" option)
       if (days === 0 || body.action === "all") {
         const result = await prisma.audit_logs.deleteMany({});
+        await logAudit({
+          request,
+          authData: request.authData,
+          action: "delete",
+          entityType: "audit_logs",
+          description: `Uživatel ${request.authData?.username ?? "unknown"} smazal všechny audit logy, počet: ${result.count}`,
+        });
         return success(reply, null, 200, `Smazáno ${result.count} záznamů`);
       }
 
@@ -62,6 +70,13 @@ export default async function auditLogRoutes(
         const result = await prisma.audit_logs.deleteMany({
           where: { created_at: { lt: cutoff } },
         });
+        await logAudit({
+          request,
+          authData: request.authData,
+          action: "delete",
+          entityType: "audit_logs",
+          description: `Uživatel ${request.authData?.username ?? "unknown"} smazal audit logy starší než ${days} dní, počet: ${result.count}`,
+        });
         return success(
           reply,
           null,