feat: NAS storage for invoices/offers, code cleanup, date/time fixes

- NAS storage for created invoices (PDF via puppeteer), received invoices,
  and offers with auto-save on create/edit
- Deterministic file paths derived from DB fields (no file_path column needed)
- Separate NAS mount points: NAS_FINANCIALS_PATH, NAS_OFFERS_PATH
- Invoice language field (cs/en) stored per invoice, replaces lang modal
- Invoices list filtered by month/year matching KPI card selection
- Centralized date helpers (src/utils/date.ts) replacing all .toISOString()
  calls that returned UTC instead of local time
- Attendance project switching uses exact time (not rounded)
- Comment cleanup: removed ~100 unnecessary/Czech comments
- Removed as-any casts in orders and attendance
- Prisma migrations: add invoice language, drop received_invoices BLOB columns

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/services/auth.ts

@@ -111,7 +111,6 @@ export async function login(
     return { type: "error", message: "Účet je deaktivován", status: 403 };
   }
 
-  // Check lockout
   if (user.locked_until && new Date(user.locked_until) > new Date()) {
     return {
       type: "error",
@@ -141,7 +140,6 @@ export async function login(
     };
   }
 
-  // Reset failed attempts
   await prisma.users.update({
     where: { id: user.id },
     data: {
@@ -151,7 +149,6 @@ export async function login(
     },
   });
 
-  // Check if 2FA is enabled
   if (user.totp_enabled) {
     const loginToken = crypto.randomBytes(32).toString("hex");
     const tokenHash = hashToken(loginToken);
@@ -167,7 +164,6 @@ export async function login(
     return { type: "totp_required", loginToken };
   }
 
-  // Generate tokens
   const authData = await loadAuthData(user.id);
   if (!authData) {
     return {
@@ -241,7 +237,6 @@ export async function refreshAccessToken(
     return { type: "error", message: "Uživatel nenalezen", status: 401 };
   }
 
-  // Rotate refresh token
   const newRefreshTokenRaw = generateRefreshToken();
   const newRefreshTokenHash = hashToken(newRefreshTokenRaw);
 
@@ -303,7 +298,6 @@ export async function logout(refreshTokenRaw: string): Promise<void> {
     });
   }
 
-  // Clean up expired tokens
   await prisma.refresh_tokens.deleteMany({
     where: { expires_at: { lt: new Date() } },
   });