feat: NAS storage for invoices/offers, code cleanup, date/time fixes

- NAS storage for created invoices (PDF via puppeteer), received invoices,
  and offers with auto-save on create/edit
- Deterministic file paths derived from DB fields (no file_path column needed)
- Separate NAS mount points: NAS_FINANCIALS_PATH, NAS_OFFERS_PATH
- Invoice language field (cs/en) stored per invoice, replaces lang modal
- Invoices list filtered by month/year matching KPI card selection
- Centralized date helpers (src/utils/date.ts) replacing all .toISOString()
  calls that returned UTC instead of local time
- Attendance project switching uses exact time (not rounded)
- Comment cleanup: removed ~100 unnecessary/Czech comments
- Removed as-any casts in orders and attendance
- Prisma migrations: add invoice language, drop received_invoices BLOB columns

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/routes/admin/totp.ts

@@ -44,7 +44,6 @@ export default async function totpRoutes(
         return error(reply, "Secret a kód jsou povinné", 400);
       }
 
-      // Verify the code first
       const totp = new OTPAuthLib.TOTP({
         secret: OTPAuthLib.Secret.fromBase32(String(secret)),
         algorithm: "SHA1",
@@ -66,7 +65,6 @@ export default async function totpRoutes(
         backupCodesHashed.push(bcrypt.hashSync(code, 10));
       }
 
-      // Encrypt and store
       const encryptedSecret = encrypt(String(secret));
       await prisma.users.update({
         where: { id: request.authData!.userId },
@@ -237,7 +235,6 @@ export default async function totpRoutes(
         return error(reply, "Neplatný záložní kód", 401);
       }
 
-      // Remove used backup code
       backupCodes.splice(matchIndex, 1);
       await prisma.users.update({
         where: { id: user.id },
@@ -249,7 +246,6 @@ export default async function totpRoutes(
         },
       });
 
-      // Delete used login token
       await prisma.totp_login_tokens.delete({ where: { id: storedToken.id } });
 
       // Create tokens (same as /login/totp flow)