feat: system settings, dynamic logos, template numbering, permission consolidation

- System settings page with tabs: Security, System, Firma
- Configurable attendance rules (break thresholds, rounding) from DB
- Configurable document numbering with template patterns ({YYYY}/{PREFIX}/{NNN})
- Dynamic logo upload (light/dark variants) served from DB instead of static files
- Email settings (SMTP from/name, alert/leave emails) configurable in UI
- Currency and VAT rate lists configurable, used across all modules
- Permissions simplified: offers.settings + settings.roles + settings.security → settings.manage
- Leaflet bundled locally, removed unpkg.com from CSP
- Silent catch blocks fixed with proper logging
- console.log replaced with app.log.info in server.ts
- Schema renamed: company-settings.schema → settings.schema
- App info section: version, Node.js, uptime, memory, DB status, NAS status

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/admin/pages/Invoices.tsx

@@ -8,7 +8,7 @@ import {
 } from "react";
 import { useAlert } from "../context/AlertContext";
 import { useAuth } from "../context/AuthContext";
-import { Link } from "react-router-dom";
+import { Link, useSearchParams } from "react-router-dom";
 import { motion, AnimatePresence } from "framer-motion";
 import ConfirmModal from "../components/ConfirmModal";
 import Forbidden from "../components/Forbidden";
@@ -119,7 +119,11 @@ export default function Invoices() {
   const alert = useAlert();
   const { hasPermission } = useAuth();
 
-  const [activeTab, setActiveTab] = useState("issued");
+  const [searchParams, setSearchParams] = useSearchParams();
+  const activeTab =
+    searchParams.get("tab") === "received" ? "received" : "issued";
+  const setActiveTab = (tab: string) =>
+    setSearchParams({ tab }, { replace: true });
   const [receivedUploadOpen, setReceivedUploadOpen] = useState(false);
   const { sort, order, handleSort, activeSort } =
     useTableSort("invoice_number");