feat: system settings, dynamic logos, template numbering, permission consolidation

- System settings page with tabs: Security, System, Firma
- Configurable attendance rules (break thresholds, rounding) from DB
- Configurable document numbering with template patterns ({YYYY}/{PREFIX}/{NNN})
- Dynamic logo upload (light/dark variants) served from DB instead of static files
- Email settings (SMTP from/name, alert/leave emails) configurable in UI
- Currency and VAT rate lists configurable, used across all modules
- Permissions simplified: offers.settings + settings.roles + settings.security → settings.manage
- Leaflet bundled locally, removed unpkg.com from CSP
- Silent catch blocks fixed with proper logging
- console.log replaced with app.log.info in server.ts
- Schema renamed: company-settings.schema → settings.schema
- App info section: version, Node.js, uptime, memory, DB status, NAS status

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/admin/pages/TripsAdmin.tsx

@@ -89,6 +89,7 @@ export default function TripsAdmin() {
   const alert = useAlert();
   const { hasPermission } = useAuth();
   const [loading, setLoading] = useState(true);
+  const [companyName, setCompanyName] = useState("");
   const [filterMonth, setFilterMonth] = useState(() =>
     String(new Date().getMonth() + 1),
   );
@@ -124,13 +125,16 @@ export default function TripsAdmin() {
   useEffect(() => {
     const fetchLookups = async () => {
       try {
-        const [vRes, uRes] = await Promise.all([
+        const [vRes, uRes, csRes] = await Promise.all([
           apiFetch(`${API_BASE}/vehicles`),
           apiFetch(`${API_BASE}/users?limit=1000`),
+          apiFetch(`${API_BASE}/company-settings`),
         ]);
         const vJson = await vRes.json();
         const uJson = await uRes.json();
+        const csJson = await csRes.json();
         if (vJson.success) setVehicles(vJson.data);
+        if (csJson.success) setCompanyName(csJson.data.company_name || "");
         if (uJson.success) {
           setUsers(
             uJson.data.map(
@@ -886,13 +890,13 @@ export default function TripsAdmin() {
           <div className="print-header">
             <div className="print-header-left">
               <img
-                src="/images/logo-light.png"
-                alt="BOHA"
+                src="/api/admin/company-settings/logo?variant=light"
+                alt=""
                 className="print-logo"
               />
               <div className="print-header-text">
                 <h1>KNIHA JÍZD</h1>
-                <div className="company">BOHA Automation s.r.o.</div>
+                <div className="company">{companyName}</div>
               </div>
             </div>
             <div className="print-header-right">