fix(freshness): converge invalidation sets; global query-error toast; silent-toggle feedback

- OrderDetail/InvoiceDetail/LeaveRequests mutations now invalidate the same
  domain sets as their list-page twins (orders+offers+projects+invoices /
  +projects / +users+dashboard) — no more stale project/order labels after
  a detail-page action.
- USER_INVALIDATE hoisted to lib/queries/users.ts; DashProfile self-edit now
  refreshes trips/attendance/leave/projects like an admin edit.
- Global QueryCache.onError toast: failed first-loads no longer masquerade as
  empty lists (data-present refetches stay silent; Unauthorized skipped; 4s
  rate limit; meta.suppressGlobalErrorToast opt-out used by offer/issued-order
  detail + the local TOTP QR query).
- Users/Vehicles active-toggle mutations toast on error (was silent revert);
  clickable status chips got affordance tooltips (incl. warehouse parity).
- AuditLog: refetchOnMount always + staleTime 0 (mutations write audit rows
  but nothing invalidates the key); search debounced; dead auditLogOptions
  module removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/admin/lib/queryClient.ts

@@ -1,6 +1,39 @@
-import { QueryClient } from "@tanstack/react-query";
+import { QueryCache, QueryClient } from "@tanstack/react-query";
+
+/**
+ * Global query-error notifier. AlertContext registers its `error()` toast
+ * here on mount; until then failures fall back to console.error.
+ */
+let queryErrorNotifier: ((msg: string) => void) | null = null;
+
+export function registerQueryErrorNotifier(fn: (msg: string) => void) {
+  queryErrorNotifier = fn;
+}
+
+/** Rate limit: at most one query-error toast per window (a page can have many failing queries). */
+const ERROR_TOAST_WINDOW_MS = 4000;
+let lastErrorToastAt = 0;
 
 export const queryClient = new QueryClient({
+  queryCache: new QueryCache({
+    onError: (error, query) => {
+      // Pages with bespoke error handling (detail pages that toast + navigate,
+      // purely-local queries like QR generation) opt out via query meta.
+      if (query.meta?.suppressGlobalErrorToast) return;
+      // Background refetch failure with stale data still on screen — stay silent.
+      if (query.state.data !== undefined) return;
+      // 401s are handled by apiFetch/AuthContext (token refresh / logout).
+      if (error instanceof Error && error.message === "Unauthorized") return;
+      const now = Date.now();
+      if (now - lastErrorToastAt < ERROR_TOAST_WINDOW_MS) return;
+      lastErrorToastAt = now;
+      if (queryErrorNotifier) {
+        queryErrorNotifier("Nepodařilo se načíst data ze serveru");
+      } else {
+        console.error("Query failed before alert notifier registered:", error);
+      }
+    },
+  }),
   defaultOptions: {
     queries: {
       staleTime: 30_000,