fix(dates): @db.Date filters built from local midnight queried the wrong day

Prisma truncates a JS Date used in a WHERE filter on a @db.Date column to
its UTC date part. Under TZ=Europe/Prague a local-midnight boundary
(new Date(y,m,d) = 22:00/23:00Z of the previous day) therefore filtered as
the PREVIOUS calendar date. Same class as the dashboard fix; full sweep of
every @db.Date filter in the codebase. New shared helper
utcMidnightOfLocalDay() in src/utils/date.ts.

Fixed (all previously off by one day):
- attendance.service: getStatus today+month windows; getWorkfund (last day
  of each month was double-counted across months); getPrintData (monthly
  print included prev month's last day); listAttendance (admin month view
  included prev month's last day AND dropped the selected month's last
  day); createAttendance duplicate/overlap validation (checked only the
  PREVIOUS day - same-day duplicates were never caught, neighbors falsely
  rejected)
- invoice-alerts: the 'splatnost za 3 dny' advance alert had NEVER fired
  (due==today+3 was outside the fetched window); window computation
  extracted as computeAlertWindow() + pure tests
- invoices.service: month list/totals filter dropped invoices issued on the
  month's last day; getInvoiceStats month/year bounds; markOverdueInvoices
  boundary; auto paid_date could store yesterday during 00:00-02:00
- received-invoices auto paid_date, issued-orders default order_date: same
  night-window write hazard, now via the helper
- attendance.schema: shift_date hardened to isoDateString (bare YYYY-MM-DD)

+9 regression tests (month boundaries, same-day duplicate, last-day-of-month
invoice in list+totals, alert window).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/schemas/attendance.schema.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import {
   intIdFromForm,
+  isoDateString,
   nullableDateTimeString,
   nullableIntIdFromForm,
   numberFromForm,
@@ -73,7 +74,10 @@ export const AttendancePunchSchema = z.object({
 // NOT bare HH:MM times.
 export const CreateAttendanceSchema = z.object({
   user_id: intIdFromForm.optional(),
-  shift_date: z.string(),
+  // Must be a bare "YYYY-MM-DD" (parses to UTC midnight) — the service's
+  // duplicate-validation window and the stored @db.Date both depend on it.
+  // isoDateString leniently strips a trailing time component.
+  shift_date: isoDateString,
   arrival_time: nullableDateTimeString.optional(),
   arrival_lat: numberFromForm.nullish(),
   arrival_lng: numberFromForm.nullish(),