feat: system settings, dynamic logos, template numbering, permission consolidation

- System settings page with tabs: Security, System, Firma
- Configurable attendance rules (break thresholds, rounding) from DB
- Configurable document numbering with template patterns ({YYYY}/{PREFIX}/{NNN})
- Dynamic logo upload (light/dark variants) served from DB instead of static files
- Email settings (SMTP from/name, alert/leave emails) configurable in UI
- Currency and VAT rate lists configurable, used across all modules
- Permissions simplified: offers.settings + settings.roles + settings.security → settings.manage
- Leaflet bundled locally, removed unpkg.com from CSP
- Silent catch blocks fixed with proper logging
- console.log replaced with app.log.info in server.ts
- Schema renamed: company-settings.schema → settings.schema
- App info section: version, Node.js, uptime, memory, DB status, NAS status

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

prisma/schema.prisma

@@ -100,6 +100,7 @@ model company_settings {
   vat_id            String?   @db.VarChar(50)
   custom_fields     String?   @db.LongText
   logo_data         Bytes?
+  logo_data_dark    Bytes?
   quotation_prefix  String?   @db.VarChar(20)
   default_currency  String?   @default("CZK") @db.VarChar(10)
   default_vat_rate  Decimal?  @default(21.00) @db.Decimal(5, 2)
@@ -109,7 +110,23 @@ model company_settings {
   sync_version      Int?      @default(0)
   order_type_code   String?   @db.VarChar(10)
   invoice_type_code String?   @db.VarChar(10)
-  require_2fa       Boolean   @default(false)
+  require_2fa              Boolean   @default(false)
+  break_threshold_hours    Decimal?  @default(6) @db.Decimal(4, 2)
+  break_duration_short     Int?      @default(15)
+  break_duration_long      Int?      @default(30)
+  clock_rounding_minutes   Int?      @default(15)
+  invoice_alert_email      String?   @db.VarChar(255)
+  leave_notify_email       String?   @db.VarChar(255)
+  max_login_attempts       Int?      @default(5)
+  lockout_minutes          Int?      @default(15)
+  max_requests_per_minute  Int?      @default(300)
+  available_vat_rates      String?   @db.LongText
+  available_currencies     String?   @db.LongText
+  smtp_from                String?   @db.VarChar(255)
+  smtp_from_name           String?   @db.VarChar(255)
+  offer_number_pattern     String?   @db.VarChar(100)
+  order_number_pattern     String?   @db.VarChar(100)
+  invoice_number_pattern   String?   @db.VarChar(100)
 }
 
 model customers {