refactor: fix all Low findings from FLAWS_REPORT audit

- Auth: TOTP params from config, JWT error logging, audit log failure
  logging, replaced_by_hash validation on token rotation
- Invoices: remove dead VAT code, consistent PDF permissions,
  WebP magic-byte detection, deduped exchange-rate fetches
- Orders/Offers: multipart limit from config, use paginated() helper,
  payment method from DB in PDF
- Projects: verify project exists before creating note
- Attendance: action_type enum validation, consistent local-time
  shift_date construction, holiday attendance in work fund,
  trips.view permission on last-km query
- Users: paginated() helper usage, remove duplicate dashboard keys,
  parallel currency conversion, single hashToken implementation
- Frontend: memoized customInput, reliable print onload, modal prop
  standardization (isOpen), ConfirmModal type icons, id===0 key
  fallback, Login useCallback, CompanySettings ConfirmModal,
  Attendance timeout cleanup, Dashboard memoization, beforeunload
  dirty-state warnings on Invoice/Offer/Order detail
- Schema: invoice_alert_log timestamp, config/env comment on
  Date.prototype.toJSON override
- Utils: exchange-rate inflight dedup

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/services/auth.ts

@@ -185,7 +185,9 @@ export async function login(
       data: {
         user_id: user.id,
         token_hash: tokenHash,
-        expires_at: new Date(Date.now() + 5 * 60_000), // 5 minutes
+        expires_at: new Date(
+          Date.now() + config.totp.loginTokenExpiryMinutes * 60_000,
+        ),
       },
     });
 
@@ -255,16 +257,18 @@ export async function refreshAccessToken(
         user_id: number;
         expires_at: Date;
         replaced_at: Date | null;
+        replaced_by_hash: string | null;
         remember_me: boolean | null;
       }>
     >`
-      SELECT id, user_id, expires_at, replaced_at, remember_me FROM refresh_tokens WHERE token_hash = ${tokenHash} FOR UPDATE
+      SELECT id, user_id, expires_at, replaced_at, replaced_by_hash, remember_me FROM refresh_tokens WHERE token_hash = ${tokenHash} FOR UPDATE
     `;
     const storedToken = tokens[0] ?? null;
 
     if (
       !storedToken ||
       storedToken.replaced_at ||
+      storedToken.replaced_by_hash ||
       new Date(storedToken.expires_at) < new Date()
     ) {
       return { type: "error", message: "Neplatný refresh token", status: 401 };
@@ -335,7 +339,8 @@ export async function verifyAccessToken(
       config.jwt.secret,
     ) as unknown as JwtPayload;
     return loadAuthData(payload.sub);
-  } catch {
+  } catch (err) {
+    console.error("JWT verification error:", err);
     return null;
   }
 }