refactor: odstraneni PSR-1 SideEffects warningu

- Handler funkce extrahovany z API souboru do api/admin/handlers/
- config.php rozdeleny na helpers.php (funkce) a constants.php (konstanty)
- require_once odstranen z class souboru (AuditLog, JWTAuth, LeaveNotification)
- vendor/autoload.php presunuto do config.php bootstrap
- totp-handlers.php: pridany use deklarace pro TwoFactorAuth
- phpstan.neon: bootstrapFiles, scanDirectories, dynamicConstantNames
- Opraveny chybejici routing bloky v totp.php a session.php

Vysledek: phpcs 0 errors 0 warnings, PHPStan 0 errors, ESLint 0 errors

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phpstan.neon

@@ -4,3 +4,12 @@ parameters:
         - api
     excludePaths:
         - vendor
+    bootstrapFiles:
+        - vendor/autoload.php
+        - api/includes/helpers.php
+        - api/includes/constants.php
+    scanDirectories:
+        - api/admin/handlers
+    dynamicConstantNames:
+        - DEBUG_MODE
+        - APP_ENV