feat: P4 backend kvalita - SELECT * fix, overdue konsolidace, Validator

- SELECT * nahrazen explicitnimi sloupci ve 22 PHP souborech (69+ vyskytu)
- users-handlers.php: password_hash explicitne vyloucen z dotazu
- Overdue detekce presunuta do invoices.php routeru (1x pred dispatch misto 3x v handlerech)
- Validator.php: validacni helper s pravidly required, string, int, email, in, numeric
- PaginationHelper: PHPStan typy opraveny

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/includes/PaginationHelper.php

@@ -14,6 +14,7 @@ class PaginationHelper
     /**
      * Nacte pagination parametry z GET requestu.
      *
+     * @param array<string, string> $sortMap
      * @return array{page: int, per_page: int, sort: string, order: string, search: string}
      */
     public static function parseParams(array $sortMap, string $defaultSort = 'created_at'): array
@@ -43,9 +44,10 @@ class PaginationHelper
      * @param PDO $pdo
      * @param string $countSql - COUNT(*) dotaz
      * @param string $dataSql - SELECT dotaz (bez LIMIT/OFFSET)
-     * @param array $params - parametry pro prepared statement
+     * @param array<int, mixed> $params - parametry pro prepared statement
      * @param array{page: int, per_page: int, sort: string, order: string} $pagination
-     * @return array{items: array, pagination: array}
+     * @return array{items: array<int, array<string, mixed>>,
+     *               pagination: array{total: int, page: int, per_page: int, total_pages: int}}
      */
     public static function paginate(
         PDO $pdo,