feat: system settings, dynamic logos, template numbering, permission consolidation

- System settings page with tabs: Security, System, Firma
- Configurable attendance rules (break thresholds, rounding) from DB
- Configurable document numbering with template patterns ({YYYY}/{PREFIX}/{NNN})
- Dynamic logo upload (light/dark variants) served from DB instead of static files
- Email settings (SMTP from/name, alert/leave emails) configurable in UI
- Currency and VAT rate lists configurable, used across all modules
- Permissions simplified: offers.settings + settings.roles + settings.security → settings.manage
- Leaflet bundled locally, removed unpkg.com from CSP
- Silent catch blocks fixed with proper logging
- console.log replaced with app.log.info in server.ts
- Schema renamed: company-settings.schema → settings.schema
- App info section: version, Node.js, uptime, memory, DB status, NAS status

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/routes/admin/scope-templates.ts

@@ -22,7 +22,7 @@ export default async function scopeTemplatesRoutes(
   // Legacy ?action= dispatcher for item templates
   fastify.get(
     "/",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const query = request.query as Record<string, unknown>;
       const action = query.action ? String(query.action) : null;
@@ -53,7 +53,7 @@ export default async function scopeTemplatesRoutes(
   // Item template CRUD via ?action=item
   fastify.post(
     "/",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const query = request.query as Record<string, unknown>;
 
@@ -121,7 +121,7 @@ export default async function scopeTemplatesRoutes(
   // Item template delete via DELETE ?action=item&id=X
   fastify.delete(
     "/",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const query = request.query as Record<string, unknown>;
 
@@ -140,7 +140,7 @@ export default async function scopeTemplatesRoutes(
 
   fastify.get<{ Params: { id: string } }>(
     "/:id",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const id = parseId(request.params.id, reply);
       if (id === null) return;
@@ -161,7 +161,7 @@ export default async function scopeTemplatesRoutes(
 
   fastify.put<{ Params: { id: string } }>(
     "/:id",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const id = parseId(request.params.id, reply);
       if (id === null) return;
@@ -208,7 +208,7 @@ export default async function scopeTemplatesRoutes(
 
   fastify.delete<{ Params: { id: string } }>(
     "/:id",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const id = parseId(request.params.id, reply);
       if (id === null) return;