security: fix all Critical and High findings from FLAWS_REPORT audit

- Auth: pessimistic locking on login tokens and refresh token rotation,
  backup code attempt counter, rate limiting verification
- Schema: unique constraints on business numbers, FK relations,
  unsigned/signed alignment, attendance duplicate prevention
- Invoices/PDFs: DOMPurify sanitization, bounded queries in stats
  and alerts, VAT rounding, Puppeteer error handling
- Orders/Offers: transactional parent+child creation, Zod NaN
  refinement, status enums, uniqueness checks
- Projects/Files: path traversal protection, streamed uploads,
  permission guards, query param validation
- Attendance/HR: duplicate checks, ownership validation, GPS
  restrictions, trip distance validation
- Frontend: modal lock reference counting, XSS escaping in print
  HTML, ref mutation fixes, accessibility attributes

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/admin/leave-requests.ts

@@ -241,6 +241,19 @@ export default async function leaveRequestsRoutes(
 
         const totalHours = totalBusinessDays * 8;
 
+        for (const ac of attendanceCreates) {
+          const duplicate = await prisma.attendance.findFirst({
+            where: { user_id: ac.user_id, shift_date: ac.shift_date },
+          });
+          if (duplicate) {
+            return error(
+              reply,
+              "Pro zvolené datumy již existují záznamy docházky",
+              400,
+            );
+          }
+        }
+
         await prisma.$transaction(async (tx) => {
           // 1. Create attendance records for each business day
           if (attendanceCreates.length > 0) {
@@ -331,6 +344,7 @@ export default async function leaveRequestsRoutes(
     "/:id",
     { preHandler: requireAuth },
     async (request, reply) => {
+      const authData = request.authData!;
       const id = parseId(request.params.id, reply);
       if (id === null) return;
       const existing = await prisma.leave_requests.findUnique({
@@ -342,6 +356,10 @@ export default async function leaveRequestsRoutes(
         return error(reply, "Lze zrušit pouze čekající žádosti", 400);
       }
 
+      if (existing.user_id !== authData.userId) {
+        return error(reply, "Nemáte oprávnění zrušit tuto žádost", 403);
+      }
+
       await prisma.leave_requests.update({
         where: { id },
         data: { status: "cancelled" },