fix(freshness): converge invalidation sets; global query-error toast; silent-toggle feedback

- OrderDetail/InvoiceDetail/LeaveRequests mutations now invalidate the same
  domain sets as their list-page twins (orders+offers+projects+invoices /
  +projects / +users+dashboard) — no more stale project/order labels after
  a detail-page action.
- USER_INVALIDATE hoisted to lib/queries/users.ts; DashProfile self-edit now
  refreshes trips/attendance/leave/projects like an admin edit.
- Global QueryCache.onError toast: failed first-loads no longer masquerade as
  empty lists (data-present refetches stay silent; Unauthorized skipped; 4s
  rate limit; meta.suppressGlobalErrorToast opt-out used by offer/issued-order
  detail + the local TOTP QR query).
- Users/Vehicles active-toggle mutations toast on error (was silent revert);
  clickable status chips got affordance tooltips (incl. warehouse parity).
- AuditLog: refetchOnMount always + staleTime 0 (mutations write audit rows
  but nothing invalidates the key); search debounced; dead auditLogOptions
  module removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/admin/components/dashboard/DashProfile.tsx

@@ -12,6 +12,7 @@ import DialogActions from "@mui/material/DialogActions";
 import { useAuth } from "../../context/AuthContext";
 import { useAlert } from "../../context/AlertContext";
 import apiFetch from "../../utils/api";
+import { USER_INVALIDATE } from "../../lib/queries/users";
 import { iconBadgeSx } from "../../theme";
 import { Card, Button, Modal, Field, TextField } from "../../ui";
 import useDialogScrollLock from "../../ui/useDialogScrollLock";
@@ -142,6 +143,9 @@ export default function DashProfile({
   const { data: totpQrDataUrl, isError: totpQrFailed } = useQuery({
     queryKey: ["totp", "qr", totpQrUri],
     enabled: !!totpQrUri,
+    // Purely local QR generation — the global "server data" error toast would
+    // misattribute a failure here; the totpQrFailed inline message covers it.
+    meta: { suppressGlobalErrorToast: true },
     staleTime: Infinity,
     // The URI embeds the TOTP secret — drop it from the cache as soon as the
     // enrollment UI unmounts instead of keeping it for the default 5-min GC.
@@ -221,9 +225,13 @@ export default function DashProfile({
           fullName: `${dataToSave.first_name} ${dataToSave.last_name}`.trim(),
         });
         // Refresh anything keyed on the current user's data so stale views
-        // (dashboard widgets, user lists) pick up the edited profile.
+        // pick up the edited profile — a self-rename must also refresh the
+        // domains embedding the display name (USER_INVALIDATE), not just the
+        // dashboard and user list.
+        for (const key of USER_INVALIDATE) {
+          queryClient.invalidateQueries({ queryKey: [key] });
+        }
         queryClient.invalidateQueries({ queryKey: ["dashboard"] });
-        queryClient.invalidateQueries({ queryKey: ["users"] });
         setShowModal(false);
         // The 300ms wait is load-bearing: it lets the modal's close fade finish
         // before the success toast appears, so the toast doesn't flash over the