security: fix all Critical and High findings from FLAWS_REPORT audit

- Auth: pessimistic locking on login tokens and refresh token rotation,
  backup code attempt counter, rate limiting verification
- Schema: unique constraints on business numbers, FK relations,
  unsigned/signed alignment, attendance duplicate prevention
- Invoices/PDFs: DOMPurify sanitization, bounded queries in stats
  and alerts, VAT rounding, Puppeteer error handling
- Orders/Offers: transactional parent+child creation, Zod NaN
  refinement, status enums, uniqueness checks
- Projects/Files: path traversal protection, streamed uploads,
  permission guards, query param validation
- Attendance/HR: duplicate checks, ownership validation, GPS
  restrictions, trip distance validation
- Frontend: modal lock reference counting, XSS escaping in print
  HTML, ref mutation fixes, accessibility attributes

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/services/numbering.service.ts

@@ -126,7 +126,7 @@ async function releaseSequence(type: string, year: number) {
 }
 
 /** Verify a shared number is not already used by an order or project. */
-async function isSharedNumberTaken(number: string): Promise<boolean> {
+export async function isSharedNumberTaken(number: string): Promise<boolean> {
   const [existingOrder, existingProject] = await Promise.all([
     prisma.orders.findFirst({ where: { order_number: number } }),
     prisma.projects.findFirst({ where: { project_number: number } }),
@@ -143,13 +143,21 @@ async function isInvoiceNumberTaken(number: string): Promise<boolean> {
 }
 
 /** Verify an offer/quotation number is not already used. */
-async function isOfferNumberTaken(number: string): Promise<boolean> {
+export async function isOfferNumberTaken(number: string): Promise<boolean> {
   const existing = await prisma.quotations.findFirst({
     where: { quotation_number: number },
   });
   return !!existing;
 }
 
+/** Verify an order number is not already used. */
+export async function isOrderNumberTaken(number: string): Promise<boolean> {
+  const existing = await prisma.orders.findFirst({
+    where: { order_number: number },
+  });
+  return !!existing;
+}
+
 /**
  * Next offer/quotation number (consumes sequence).
  * Verifies uniqueness against the quotations table; retries if taken.