refactor: fix all Low findings from FLAWS_REPORT audit

- Auth: TOTP params from config, JWT error logging, audit log failure
  logging, replaced_by_hash validation on token rotation
- Invoices: remove dead VAT code, consistent PDF permissions,
  WebP magic-byte detection, deduped exchange-rate fetches
- Orders/Offers: multipart limit from config, use paginated() helper,
  payment method from DB in PDF
- Projects: verify project exists before creating note
- Attendance: action_type enum validation, consistent local-time
  shift_date construction, holiday attendance in work fund,
  trips.view permission on last-km query
- Users: paginated() helper usage, remove duplicate dashboard keys,
  parallel currency conversion, single hashToken implementation
- Frontend: memoized customInput, reliable print onload, modal prop
  standardization (isOpen), ConfirmModal type icons, id===0 key
  fallback, Login useCallback, CompanySettings ConfirmModal,
  Attendance timeout cleanup, Dashboard memoization, beforeunload
  dirty-state warnings on Invoice/Offer/Order detail
- Schema: invoice_alert_log timestamp, config/env comment on
  Date.prototype.toJSON override
- Utils: exchange-rate inflight dedup

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/admin/dashboard.ts

@@ -200,23 +200,25 @@ export default async function dashboardRoutes(
           (revenueByCurrency[currency] || 0) + amount;
       }
 
+      const revenueConversions = await Promise.all(
+        Object.entries(revenueByCurrency).map(async ([currency, amount]) => ({
+          amount: Math.round(amount * 100) / 100,
+          currency,
+          czk: await toCzk(Math.round(amount * 100) / 100, currency),
+        })),
+      );
+
       result.invoices = {
-        revenue_this_month: Object.entries(revenueByCurrency).map(
-          ([currency, amount]) => ({
-            amount: Math.round(amount * 100) / 100,
-            currency,
-          }),
-        ),
+        revenue_this_month: revenueConversions.map(({ amount, currency }) => ({
+          amount,
+          currency,
+        })),
         unpaid_count: unpaidCount,
-        revenue_czk: await (async () => {
-          let total = 0;
-          for (const [cur, amount] of Object.entries(revenueByCurrency)) {
-            total += await toCzk(Math.round(amount * 100) / 100, cur);
-          }
-          return Math.round(total * 100) / 100;
-        })(),
+        revenue_czk:
+          Math.round(
+            revenueConversions.reduce((sum, r) => sum + r.czk, 0) * 100,
+          ) / 100,
       };
-      result.unpaid_invoices = unpaidCount;
     }
 
     // Orders — only for orders.view
@@ -232,7 +234,6 @@ export default async function dashboardRoutes(
         where: { status: "pending" },
       });
       result.leave_pending = { count };
-      result.pending_leave_requests = count;
     }
 
     // Recent activity — only for settings.audit (admin)