feat: mobilni responsivita, testy, klavesove zkratky, drag & drop, univerzalizace

- Mobile responsive CSS (touch targets 44px, iOS anti-zoom, reduced motion)
- Vitest setup s 39 testy (formatters, attendanceHelpers, useTableSort)
- Klavesove zkratky (Shift+? napoveda, Ctrl+S ulozit, navigace)
- Drag & drop pro polozky nabidek (@dnd-kit, SortableRow, useSortableList)
- Univerzalizace: odstraneni BOHA brandingu z UI, emailu, PDF
- Smazany nepotrebne soubory (deploy.sh, AUTH_SYSTEM.md, example_design, .htaccess)
- CORS konfigurovatelny pres env promennou

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/includes/constants.php

@@ -25,11 +25,10 @@ define('MAX_LOGIN_ATTEMPTS', 5);
 define('LOCKOUT_MINUTES', 15);
 define('BCRYPT_COST', 12);
 
-// CORS - aktualizuj po nasazeni na subdomenu
-define('CORS_ALLOWED_ORIGINS', [
-    'http://www.boha-automation.cz',
-    'https://www.boha-automation.cz',
-]);
+// CORS - konfigurovatelne pres env (comma-separated), fallback na hardcoded hodnoty
+define('CORS_ALLOWED_ORIGINS', env('CORS_ALLOWED_ORIGINS', '')
+    ? array_map('trim', explode(',', (string) env('CORS_ALLOWED_ORIGINS', '')))
+    : ['http://www.boha-automation.cz', 'https://www.boha-automation.cz']);
 
 // Paths
 define('API_ROOT', dirname(__DIR__));