feat: system settings, dynamic logos, template numbering, permission consolidation

- System settings page with tabs: Security, System, Firma
- Configurable attendance rules (break thresholds, rounding) from DB
- Configurable document numbering with template patterns ({YYYY}/{PREFIX}/{NNN})
- Dynamic logo upload (light/dark variants) served from DB instead of static files
- Email settings (SMTP from/name, alert/leave emails) configurable in UI
- Currency and VAT rate lists configurable, used across all modules
- Permissions simplified: offers.settings + settings.roles + settings.security → settings.manage
- Leaflet bundled locally, removed unpkg.com from CSP
- Silent catch blocks fixed with proper logging
- console.log replaced with app.log.info in server.ts
- Schema renamed: company-settings.schema → settings.schema
- App info section: version, Node.js, uptime, memory, DB status, NAS status

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/config/env.ts

@@ -63,7 +63,7 @@ export const config = {
     contactTo: process.env.CONTACT_EMAIL_TO || "",
     contactFrom: process.env.CONTACT_EMAIL_FROM || "",
     smtpFrom: process.env.SMTP_FROM || "",
-    smtpFromName: process.env.SMTP_FROM_NAME || "BOHA Automation",
+    smtpFromName: process.env.SMTP_FROM_NAME || "",
     leaveNotify: process.env.LEAVE_NOTIFY_EMAIL || "",
     invoiceAlert: process.env.INVOICE_ALERT_EMAIL || "",
   },
@@ -75,8 +75,6 @@ export const config = {
   },
 
   security: {
-    maxLoginAttempts: 5,
-    lockoutMinutes: 15,
     bcryptCost: 12,
   },
 } as const;