feat(plan): validate dynamic category keys, resolve audit label from DB

- Replace hardcoded planCategoryEnum z.enum with z.string().trim().min(1)
- Add assertActiveCategory() helper that rejects inactive/unknown keys
- Add resolveCategoryLabel() helper that resolves the Czech label from plan_categories DB table, falling back to built-in map
- Change PlanAuditDescriptionInput.category -> categoryLabel (pre-resolved string)
- Update buildPlanAuditDescription to use opts.categoryLabel directly
- Update all 6 buildPlanAuditDescription call sites in plan.service.ts to await resolveCategoryLabel(row.category)
- Add category validation in createEntry, updateEntry, createOverride, updateOverride
- Update planAuditDescription tests to pass categoryLabel instead of category

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/schemas/plan.schema.ts

@@ -9,15 +9,9 @@ const intFromForm = z
   .transform((v) => Number(v))
   .refine((n) => Number.isInteger(n) && n > 0, "Neplatné ID");
 
-const planCategoryEnum = z.enum([
-  "work",
-  "preparation",
-  "travel",
-  "leave",
-  "sick",
-  "training",
-  "other",
-]);
+// Category is now a dynamic key (validated against plan_categories in the
+// service). Keep it a non-empty string here.
+const planCategoryEnum = z.string().trim().min(1, "Kategorie je povinná");
 
 export const CreatePlanEntrySchema = z
   .object({