feat: P4 backend kvalita - SELECT * fix, overdue konsolidace, Validator

- SELECT * nahrazen explicitnimi sloupci ve 22 PHP souborech (69+ vyskytu)
- users-handlers.php: password_hash explicitne vyloucen z dotazu
- Overdue detekce presunuta do invoices.php routeru (1x pred dispatch misto 3x v handlerech)
- Validator.php: validacni helper s pravidly required, string, int, email, in, numeric
- PaginationHelper: PHPStan typy opraveny

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/admin/handlers/leave-requests-handlers.php

@@ -31,7 +31,10 @@ function getLeaveBalanceForRequest(PDO $pdo, int $userId, ?int $year = null): ar
 {
     $year = $year ?: (int)date('Y');
 
-    $stmt = $pdo->prepare('SELECT * FROM leave_balances WHERE user_id = ? AND year = ?');
+    $stmt = $pdo->prepare(
+        'SELECT id, user_id, year, vacation_total, vacation_used, sick_used
+        FROM leave_balances WHERE user_id = ? AND year = ?'
+    );
     $stmt->execute([$userId, $year]);
     $balance = $stmt->fetch();
 
@@ -77,7 +80,9 @@ function getPendingVacationHours(PDO $pdo, int $userId, int $year): float
 function handleGetMyRequests(PDO $pdo, int $userId): void
 {
     $stmt = $pdo->prepare("
-        SELECT lr.*,
+        SELECT lr.id, lr.user_id, lr.leave_type, lr.date_from, lr.date_to,
+               lr.total_hours, lr.total_days, lr.notes, lr.status,
+               lr.reviewer_id, lr.reviewer_note, lr.reviewed_at, lr.created_at,
                CONCAT(u.first_name, ' ', u.last_name) as reviewer_name
         FROM leave_requests lr
         LEFT JOIN users u ON lr.reviewer_id = u.id
@@ -96,7 +101,9 @@ function handleGetMyRequests(PDO $pdo, int $userId): void
 function handleGetPending(PDO $pdo): void
 {
     $stmt = $pdo->prepare("
-        SELECT lr.*,
+        SELECT lr.id, lr.user_id, lr.leave_type, lr.date_from, lr.date_to,
+               lr.total_hours, lr.total_days, lr.notes, lr.status,
+               lr.reviewer_id, lr.reviewer_note, lr.reviewed_at, lr.created_at,
                CONCAT(u.first_name, ' ', u.last_name) as employee_name,
                CONCAT(rv.first_name, ' ', rv.last_name) as reviewer_name
         FROM leave_requests lr
@@ -138,7 +145,9 @@ function handleGetAll(PDO $pdo): void
     $whereClause = $where ? 'WHERE ' . implode(' AND ', $where) : '';
 
     $stmt = $pdo->prepare("
-        SELECT lr.*,
+        SELECT lr.id, lr.user_id, lr.leave_type, lr.date_from, lr.date_to,
+               lr.total_hours, lr.total_days, lr.notes, lr.status,
+               lr.reviewer_id, lr.reviewer_note, lr.reviewed_at, lr.created_at,
                CONCAT(u.first_name, ' ', u.last_name) as employee_name,
                CONCAT(rv.first_name, ' ', rv.last_name) as reviewer_name
         FROM leave_requests lr
@@ -270,7 +279,11 @@ function handleCancelRequest(PDO $pdo, int $userId): void
         errorResponse('ID žádosti je povinné');
     }
 
-    $stmt = $pdo->prepare('SELECT * FROM leave_requests WHERE id = ? AND user_id = ?');
+    $stmt = $pdo->prepare(
+        'SELECT id, user_id, leave_type, date_from, date_to, total_hours,
+                total_days, notes, status
+        FROM leave_requests WHERE id = ? AND user_id = ?'
+    );
     $stmt->execute([$requestId, $userId]);
     $request = $stmt->fetch();
 
@@ -310,7 +323,11 @@ function handleApproveRequest(PDO $pdo, int $reviewerId, array $authData): void
         errorResponse('ID žádosti je povinné');
     }
 
-    $stmt = $pdo->prepare('SELECT * FROM leave_requests WHERE id = ?');
+    $stmt = $pdo->prepare(
+        'SELECT id, user_id, leave_type, date_from, date_to, total_hours,
+                total_days, status
+        FROM leave_requests WHERE id = ?'
+    );
     $stmt->execute([$requestId]);
     $request = $stmt->fetch();
 
@@ -427,7 +444,9 @@ function handleRejectRequest(PDO $pdo, int $reviewerId, array $authData): void
         errorResponse('Důvod zamítnutí je povinný');
     }
 
-    $stmt = $pdo->prepare('SELECT * FROM leave_requests WHERE id = ?');
+    $stmt = $pdo->prepare(
+        'SELECT id, user_id, status FROM leave_requests WHERE id = ?'
+    );
     $stmt->execute([$requestId]);
     $request = $stmt->fetch();