feat: system settings, dynamic logos, template numbering, permission consolidation

- System settings page with tabs: Security, System, Firma
- Configurable attendance rules (break thresholds, rounding) from DB
- Configurable document numbering with template patterns ({YYYY}/{PREFIX}/{NNN})
- Dynamic logo upload (light/dark variants) served from DB instead of static files
- Email settings (SMTP from/name, alert/leave emails) configurable in UI
- Currency and VAT rate lists configurable, used across all modules
- Permissions simplified: offers.settings + settings.roles + settings.security → settings.manage
- Leaflet bundled locally, removed unpkg.com from CSP
- Silent catch blocks fixed with proper logging
- console.log replaced with app.log.info in server.ts
- Schema renamed: company-settings.schema → settings.schema
- App info section: version, Node.js, uptime, memory, DB status, NAS status

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/services/invoices.service.ts

@@ -69,8 +69,8 @@ export async function markOverdueInvoices() {
       where: { status: "issued", due_date: { lt: new Date() } },
       data: { status: "overdue" },
     });
-  } catch {
-    /* silent */
+  } catch (err) {
+    console.error("markOverdueInvoices failed:", err);
   }
 }
 
@@ -141,26 +141,7 @@ export async function listInvoices(params: ListInvoicesParams) {
   return { data: enriched, total, page, limit };
 }
 
-export async function getNextInvoiceNumberFormatted() {
-  const settings = await prisma.company_settings.findFirst({
-    select: { invoice_type_code: true },
-  });
-  const typeCode = settings?.invoice_type_code || "81";
-  const yy = String(new Date().getFullYear()).slice(-2);
-  const prefix = `${yy}${typeCode}`;
-  const prefixLen = prefix.length;
-  const likePattern = `${prefix}%`;
-
-  // MAX from existing invoices — same approach as offers/orders
-  const result = await prisma.$queryRaw<[{ max_num: bigint | null }]>`
-    SELECT COALESCE(MAX(CAST(SUBSTRING(invoice_number, ${prefixLen} + 1) AS UNSIGNED)), 0) as max_num
-    FROM invoices
-    WHERE invoice_number LIKE ${likePattern}
-  `;
-  const nextNum = Number(result[0]?.max_num ?? 0) + 1;
-  const number = `${prefix}${String(nextNum).padStart(4, "0")}`;
-  return { number, next_number: number };
-}
+export { generateInvoiceNumber as getNextInvoiceNumberFormatted } from "./numbering.service";
 
 export async function getInvoiceStats(queryMonth?: number, queryYear?: number) {
   const now = new Date();