refactor: fix all Low findings from FLAWS_REPORT audit

- Auth: TOTP params from config, JWT error logging, audit log failure
  logging, replaced_by_hash validation on token rotation
- Invoices: remove dead VAT code, consistent PDF permissions,
  WebP magic-byte detection, deduped exchange-rate fetches
- Orders/Offers: multipart limit from config, use paginated() helper,
  payment method from DB in PDF
- Projects: verify project exists before creating note
- Attendance: action_type enum validation, consistent local-time
  shift_date construction, holiday attendance in work fund,
  trips.view permission on last-km query
- Users: paginated() helper usage, remove duplicate dashboard keys,
  parallel currency conversion, single hashToken implementation
- Frontend: memoized customInput, reliable print onload, modal prop
  standardization (isOpen), ConfirmModal type icons, id===0 key
  fallback, Login useCallback, CompanySettings ConfirmModal,
  Attendance timeout cleanup, Dashboard memoization, beforeunload
  dirty-state warnings on Invoice/Offer/Order detail
- Schema: invoice_alert_log timestamp, config/env comment on
  Date.prototype.toJSON override
- Utils: exchange-rate inflight dedup

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/admin/pages/Login.tsx

@@ -1,4 +1,4 @@
-import { useState, useEffect, useRef } from "react";
+import { useState, useEffect, useRef, useCallback } from "react";
 import { Navigate } from "react-router-dom";
 import { motion, AnimatePresence } from "framer-motion";
 import { useAuth } from "../context/AuthContext";
@@ -57,62 +57,91 @@ export default function Login() {
     return <Navigate to="/" replace />;
   }
 
-  const handleSubmit = async (e: React.FormEvent) => {
-    e.preventDefault();
-    setLoading(true);
+  const handleSubmit = useCallback(
+    async (e: React.FormEvent) => {
+      e.preventDefault();
+      setLoading(true);
 
-    const result = await login(username, password, remember);
+      const result = await login(username, password, remember);
 
-    if (result.requires2FA) {
-      setLoginToken(result.loginToken ?? null);
-      setShow2FA(true);
-      setTotpCode("");
-      setLoading(false);
-    } else if (!result.success) {
-      alert.error(result.error ?? "Chyba přihlášení");
-      setShake(true);
-      setTimeout(() => setShake(false), 500);
-      setLoading(false);
-    } else {
-      alert.success("Úspěšně přihlášeno");
-      setAnimatingOut(true);
-      setTimeout(() => setAnimatingOut(false), 400);
-    }
-  };
+      if (result.requires2FA) {
+        setLoginToken(result.loginToken ?? null);
+        setShow2FA(true);
+        setTotpCode("");
+        setLoading(false);
+      } else if (!result.success) {
+        alert.error(result.error ?? "Chyba přihlášení");
+        setShake(true);
+        setTimeout(() => setShake(false), 500);
+        setLoading(false);
+      } else {
+        alert.success("Úspěšně přihlášeno");
+        setAnimatingOut(true);
+        setTimeout(() => setAnimatingOut(false), 400);
+      }
+    },
+    [
+      username,
+      password,
+      remember,
+      login,
+      alert,
+      setLoading,
+      setShake,
+      setAnimatingOut,
+      setLoginToken,
+      setShow2FA,
+      setTotpCode,
+    ],
+  );
 
-  const handle2FASubmit = async (e: React.FormEvent) => {
-    e.preventDefault();
-    if (!totpCode.trim()) return;
+  const handle2FASubmit = useCallback(
+    async (e: React.FormEvent) => {
+      e.preventDefault();
+      if (!totpCode.trim()) return;
 
-    setLoading(true);
+      setLoading(true);
 
-    const result = await verify2FA(
-      loginToken!,
-      totpCode.trim(),
+      const result = await verify2FA(
+        loginToken!,
+        totpCode.trim(),
+        remember,
+        useBackupCode,
+      );
+
+      if (!result.success) {
+        alert.error(result.error ?? "Chyba ověření");
+        setShake(true);
+        setTimeout(() => setShake(false), 500);
+        setTotpCode("");
+        if (totpInputRef.current) totpInputRef.current.focus();
+        setLoading(false);
+      } else {
+        alert.success("Úspěšně přihlášeno");
+        setAnimatingOut(true);
+        setTimeout(() => setAnimatingOut(false), 400);
+      }
+    },
+    [
+      totpCode,
+      loginToken,
       remember,
       useBackupCode,
-    );
+      verify2FA,
+      alert,
+      setLoading,
+      setShake,
+      setTotpCode,
+      setAnimatingOut,
+    ],
+  );
 
-    if (!result.success) {
-      alert.error(result.error ?? "Chyba ověření");
-      setShake(true);
-      setTimeout(() => setShake(false), 500);
-      setTotpCode("");
-      if (totpInputRef.current) totpInputRef.current.focus();
-      setLoading(false);
-    } else {
-      alert.success("Úspěšně přihlášeno");
-      setAnimatingOut(true);
-      setTimeout(() => setAnimatingOut(false), 400);
-    }
-  };
-
-  const handleBack = () => {
+  const handleBack = useCallback(() => {
     setShow2FA(false);
     setLoginToken(null);
     setTotpCode("");
     setUseBackupCode(false);
-  };
+  }, [setShow2FA, setLoginToken, setTotpCode, setUseBackupCode]);
 
   return (
     <motion.div