feat: system settings, dynamic logos, template numbering, permission consolidation

- System settings page with tabs: Security, System, Firma
- Configurable attendance rules (break thresholds, rounding) from DB
- Configurable document numbering with template patterns ({YYYY}/{PREFIX}/{NNN})
- Dynamic logo upload (light/dark variants) served from DB instead of static files
- Email settings (SMTP from/name, alert/leave emails) configurable in UI
- Currency and VAT rate lists configurable, used across all modules
- Permissions simplified: offers.settings + settings.roles + settings.security → settings.manage
- Leaflet bundled locally, removed unpkg.com from CSP
- Silent catch blocks fixed with proper logging
- console.log replaced with app.log.info in server.ts
- Schema renamed: company-settings.schema → settings.schema
- App info section: version, Node.js, uptime, memory, DB status, NAS status

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

prisma/migrations/20260327_add_system_settings/migration.sql

@@ -0,0 +1,13 @@
+-- System settings columns on company_settings
+ALTER TABLE `company_settings`
+  ADD COLUMN `break_threshold_hours` DECIMAL(4,2) DEFAULT 6,
+  ADD COLUMN `break_duration_short` INT DEFAULT 15,
+  ADD COLUMN `break_duration_long` INT DEFAULT 30,
+  ADD COLUMN `clock_rounding_minutes` INT DEFAULT 15,
+  ADD COLUMN `invoice_alert_email` VARCHAR(255) NULL,
+  ADD COLUMN `leave_notify_email` VARCHAR(255) NULL,
+  ADD COLUMN `max_login_attempts` INT DEFAULT 5,
+  ADD COLUMN `lockout_minutes` INT DEFAULT 15,
+  ADD COLUMN `max_requests_per_minute` INT DEFAULT 300,
+  ADD COLUMN `available_vat_rates` LONGTEXT NULL,
+  ADD COLUMN `available_currencies` LONGTEXT NULL;