feat: P4 backend kvalita - SELECT * fix, overdue konsolidace, Validator

- SELECT * nahrazen explicitnimi sloupci ve 22 PHP souborech (69+ vyskytu)
- users-handlers.php: password_hash explicitne vyloucen z dotazu
- Overdue detekce presunuta do invoices.php routeru (1x pred dispatch misto 3x v handlerech)
- Validator.php: validacni helper s pravidly required, string, int, email, in, numeric
- PaginationHelper: PHPStan typy opraveny

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/admin/handlers/invoices-handlers.php

@@ -99,9 +99,6 @@ function handleGetStats(PDO $pdo): void
     $month = max(1, min(12, (int) ($_GET['month'] ?? (int) date('n'))));
     $year = max(2020, min(2099, (int) ($_GET['year'] ?? (int) date('Y'))));
 
-    // Lazy overdue detekce
-    $pdo->exec("UPDATE invoices SET status = 'overdue' WHERE status = 'issued' AND due_date < CURDATE()");
-
     $monthStart = sprintf('%04d-%02d-01', $year, $month);
     $monthEnd = date('Y-m-t', strtotime($monthStart));
 
@@ -186,9 +183,6 @@ function handleGetList(PDO $pdo): void
 
     $p = PaginationHelper::parseParams($sortMap);
 
-    // Lazy overdue detekce
-    $pdo->exec("UPDATE invoices SET status = 'overdue' WHERE status = 'issued' AND due_date < CURDATE()");
-
     $where = 'WHERE 1=1';
     $params = [];
 
@@ -253,13 +247,14 @@ function handleGetList(PDO $pdo): void
 
 function handleGetDetail(PDO $pdo, int $id): void
 {
-    // Lazy overdue
-    $pdo->prepare(
-        "UPDATE invoices SET status = 'overdue' WHERE id = ? AND status = 'issued' AND due_date < CURDATE()"
-    )->execute([$id]);
-
     $stmt = $pdo->prepare('
-        SELECT i.*, c.name as customer_name, o.order_number
+        SELECT i.id, i.invoice_number, i.order_id, i.customer_id, i.status,
+               i.currency, i.vat_rate, i.apply_vat, i.payment_method,
+               i.constant_symbol, i.bank_name, i.bank_swift, i.bank_iban,
+               i.bank_account, i.issue_date, i.due_date, i.tax_date,
+               i.paid_date, i.issued_by, i.notes, i.internal_notes,
+               i.created_at, i.modified_at,
+               c.name as customer_name, o.order_number
         FROM invoices i
         LEFT JOIN customers c ON i.customer_id = c.id
         LEFT JOIN orders o ON i.order_id = o.id
@@ -273,7 +268,10 @@ function handleGetDetail(PDO $pdo, int $id): void
     }
 
     // Polozky
-    $stmt = $pdo->prepare('SELECT * FROM invoice_items WHERE invoice_id = ? ORDER BY position');
+    $stmt = $pdo->prepare(
+        'SELECT id, invoice_id, description, quantity, unit, unit_price, vat_rate, position
+        FROM invoice_items WHERE invoice_id = ? ORDER BY position'
+    );
     $stmt->execute([$id]);
     $invoice['items'] = $stmt->fetchAll();
 
@@ -317,7 +315,11 @@ function handleGetOrderData(PDO $pdo, int $id): void
     }
 
     // Polozky objednavky
-    $stmt = $pdo->prepare('SELECT * FROM order_items WHERE order_id = ? ORDER BY position');
+    $stmt = $pdo->prepare(
+        'SELECT id, order_id, description, item_description, quantity, unit,
+                unit_price, is_included_in_total, position
+        FROM order_items WHERE order_id = ? ORDER BY position'
+    );
     $stmt->execute([$id]);
     $order['items'] = $stmt->fetchAll();
 
@@ -506,7 +508,14 @@ function handleCreateInvoice(PDO $pdo, array $authData): void
 
 function handleUpdateInvoice(PDO $pdo, int $id): void
 {
-    $stmt = $pdo->prepare('SELECT * FROM invoices WHERE id = ?');
+    $stmt = $pdo->prepare(
+        'SELECT id, invoice_number, order_id, customer_id, status, currency,
+                vat_rate, apply_vat, payment_method, constant_symbol,
+                bank_name, bank_swift, bank_iban, bank_account,
+                issue_date, due_date, tax_date, paid_date,
+                issued_by, notes, internal_notes
+        FROM invoices WHERE id = ?'
+    );
     $stmt->execute([$id]);
     $invoice = $stmt->fetch();
 
@@ -657,7 +666,9 @@ function handleUpdateInvoice(PDO $pdo, int $id): void
 
 function handleDeleteInvoice(PDO $pdo, int $id): void
 {
-    $stmt = $pdo->prepare('SELECT * FROM invoices WHERE id = ?');
+    $stmt = $pdo->prepare(
+        'SELECT id, invoice_number, customer_id FROM invoices WHERE id = ?'
+    );
     $stmt->execute([$id]);
     $invoice = $stmt->fetch();