refactor: odstraneni PSR-1 SideEffects warningu

- Handler funkce extrahovany z API souboru do api/admin/handlers/
- config.php rozdeleny na helpers.php (funkce) a constants.php (konstanty)
- require_once odstranen z class souboru (AuditLog, JWTAuth, LeaveNotification)
- vendor/autoload.php presunuto do config.php bootstrap
- totp-handlers.php: pridany use deklarace pro TwoFactorAuth
- phpstan.neon: bootstrapFiles, scanDirectories, dynamicConstantNames
- Opraveny chybejici routing bloky v totp.php a session.php

Vysledek: phpcs 0 errors 0 warnings, PHPStan 0 errors, ESLint 0 errors

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/includes/constants.php

@@ -0,0 +1,39 @@
+<?php
+
+/**
+ * Aplikacni konstanty
+ *
+ * Definuje konstanty pouzivane v celé API.
+ * Vyzaduje, aby byl pred includovanim tohoto souboru nacten helpers.php a .env.
+ */
+
+declare(strict_types=1);
+
+// Environment
+define('APP_ENV', env('APP_ENV', 'production'));
+define('DEBUG_MODE', APP_ENV === 'local');
+
+// Database configuration
+define('DB_HOST', env('DB_HOST', 'localhost'));
+define('DB_NAME', env('DB_NAME', ''));
+define('DB_USER', env('DB_USER', ''));
+define('DB_PASS', env('DB_PASS', ''));
+define('DB_CHARSET', 'utf8mb4');
+
+// Security configuration
+define('MAX_LOGIN_ATTEMPTS', 5);
+define('LOCKOUT_MINUTES', 15);
+define('BCRYPT_COST', 12);
+
+// CORS - aktualizuj po nasazeni na subdomenu
+define('CORS_ALLOWED_ORIGINS', [
+    'http://www.boha-automation.cz',
+    'https://www.boha-automation.cz',
+]);
+
+// Paths
+define('API_ROOT', dirname(__DIR__));
+define('INCLUDES_PATH', API_ROOT . '/includes');
+
+// Rate limiting
+define('RATE_LIMIT_STORAGE_PATH', dirname(__DIR__) . '/rate_limits');