feat: system settings, dynamic logos, template numbering, permission consolidation

- System settings page with tabs: Security, System, Firma
- Configurable attendance rules (break thresholds, rounding) from DB
- Configurable document numbering with template patterns ({YYYY}/{PREFIX}/{NNN})
- Dynamic logo upload (light/dark variants) served from DB instead of static files
- Email settings (SMTP from/name, alert/leave emails) configurable in UI
- Currency and VAT rate lists configurable, used across all modules
- Permissions simplified: offers.settings + settings.roles + settings.security → settings.manage
- Leaflet bundled locally, removed unpkg.com from CSP
- Silent catch blocks fixed with proper logging
- console.log replaced with app.log.info in server.ts
- Schema renamed: company-settings.schema → settings.schema
- App info section: version, Node.js, uptime, memory, DB status, NAS status

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/services/auth.ts

@@ -5,6 +5,7 @@ import { FastifyRequest, FastifyReply } from "fastify";
 import prisma from "../config/database";
 import { config } from "../config/env";
 import { AuthData, JwtPayload } from "../types";
+import { getSystemSettings } from "./system-settings";
 
 // Pre-computed bcrypt hash for timing-safe comparison when user not found
 const DUMMY_HASH =
@@ -121,14 +122,15 @@ export async function login(
 
   const passwordValid = await bcrypt.compare(password, user.password_hash);
   if (!passwordValid) {
+    const settings = await getSystemSettings();
     const attempts = (user.failed_login_attempts ?? 0) + 1;
     const updateData: Record<string, unknown> = {
       failed_login_attempts: attempts,
     };
 
-    if (attempts >= config.security.maxLoginAttempts) {
+    if (attempts >= settings.max_login_attempts) {
       updateData.locked_until = new Date(
-        Date.now() + config.security.lockoutMinutes * 60_000,
+        Date.now() + settings.lockout_minutes * 60_000,
       );
     }