feat(documents)!: unify offers and issued orders end to end

One coherent pass over the two sibling document models, driven by a 3-lens
1:1 scan (~60 divergences inventoried) + user decisions. Migration adds
issued_orders.locked_by/locked_at and the issued_order_sections table
(mirror of scope_sections; applied to dev + test DBs).

Issued orders gained (offers as reference implementation):
- rich-text SECTIONS with CZ/EN titles, rendered on their own PDF page in
  the PO template's red style (shared DocumentSectionSchema, one-transaction
  create/update incl. items - fixes a torn-write bug)
- edit LOCKING (lock/heartbeat/unlock routes, 423 + holder name, 30s TTL =
  3 missed 10s heartbeats; locked_by enrichment on detail)
- archived-PDF serving: GET /:id/file reads the NAS copy (new
  readIssuedByNumber sweep) with live-render fallback + re-archive; offers'
  /file got the same fallback (kills the 'ulozte nabidku' dead end)
- NAS cleanup on delete, in-tx po_number uniqueness (409), collision-advancing
  number previews (also invoice previews), PUT returns assigned po_number

Offers hardened (issued as reference):
- VALID_TRANSITIONS enforced (no more numberless 'ordered' offers; invalidate
  follows the table; order creation only from active offers) +
  valid_transitions on detail
- explicit 400 instead of silent edits outside draft/active (mirrored on
  issued: explicit 400 replaced silent drops)
- customer existence check + Number(null)->0 clear bug fixed; delete of a
  linked offer -> 409 instead of P2003 500; error-token convention; Zod caps
  DB-aligned (desc 500/unit 20/number 50/project_code 100, isoDateString
  dates, ints for positions); audit old/new values + koncept fallbacks;
  list id tiebreaks; stats include trimmed; NAS delete dedupe

Frontend unification (6 new shared modules):
- components/document/{DocumentItemsEditor,SectionsEditor,LockBanner}
- hooks/{useDocumentLock,useUnsavedChangesGuard,useDocumentPdf(+list variant)}
- OfferDetail 1940->1100 lines, IssuedOrderDetail 1400->980: headline-only
  document number (form field removed), one form layout/readonly convention,
  view-permission opens read-only everywhere (issued's editable-for-viewers
  hole closed), server-driven transition buttons, dirty guard + Enter submit
  on both, useApiMutation everywhere (new opt-in envelope mode), fixed
  infinite spinner on failed detail fetch, draft PDFs hidden (no number yet)
- lists: supplier filter + count line on issued, Mena column dropped + mono
  numbers on offers, shared hardened per-row PDF flow (spinner, double-click
  guard, 401 close, blob cleanup), proper Czech quotes, real CTA empty
  states, query-lib cleanups (["offers","customers"] key, typed list rows,
  shared CurrencyAmount, retry:false on details)
- pdf-shared.ts: one escapeHtml/cleanQuillHtml(strict)/formatNum(NBSP)/
  formatCurrency/formatDate for all four PDF routes; offer PDF keeps its
  monochrome look (fractional qty fix: 1.5 no longer prints as 2); issued
  PDF language now comes from the document column

+49 tests (suite 364 -> 413). Each stage passed an independent review; final
cross-stage integration review verified the FE<->BE contracts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/utils/pdf-shared.ts

@@ -0,0 +1,116 @@
+import { localDateCzStr } from "./date";
+
+/**
+ * Shared helpers for the four PDF routes (offers-pdf, issued-orders-pdf,
+ * invoices-pdf, orders-pdf). These used to be near-verbatim copies in each
+ * route file; the canonical variants live here:
+ *
+ * - `cleanQuillHtml` is the STRICT variant (strips javascript:/data:/vbscript:
+ *   in BOTH href and src — defense-in-depth, DOMPurify runs first).
+ * - `formatNum` uses the NBSP (U+00A0) thousands separator so amounts never
+ *   line-wrap inside the number.
+ * - `formatCurrency` is the per-currency-symbol variant from offers
+ *   (€ / $ / Kč / £, anything else falls back to "<num> <code>").
+ */
+
+/** dd.MM.yyyy in Europe/Prague; invalid input echoes back as-is. */
+export function formatDate(date: Date | string | null | undefined): string {
+  if (!date) return "";
+  const d = new Date(date);
+  if (isNaN(d.getTime())) return String(date);
+  return localDateCzStr(d);
+}
+
+/** Format number with comma decimal separator and NBSP thousands separator. */
+export function formatNum(n: number, decimals = 2): string {
+  const abs = Math.abs(n);
+  const fixed = abs.toFixed(decimals);
+  const [intPart, decPart] = fixed.split(".");
+  const withSep = intPart.replace(/\B(?=(\d{3})+(?!\d))/g, " ");
+  const result = decPart ? `${withSep},${decPart}` : withSep;
+  return n < 0 ? `-${result}` : result;
+}
+
+/** Per-currency symbol formatting (offers variant). */
+export function formatCurrency(amount: number, currency: string): string {
+  const n = Number(amount) || 0;
+  switch (currency) {
+    case "EUR":
+      return `${formatNum(n, 2)} €`;
+    case "USD":
+      return `$${Math.abs(n)
+        .toFixed(2)
+        .replace(/\B(?=(\d{3})+(?!\d))/g, ",")}`;
+    case "CZK":
+      return `${formatNum(n, 2)} Kč`;
+    case "GBP":
+      return `£${Math.abs(n)
+        .toFixed(2)
+        .replace(/\B(?=(\d{3})+(?!\d))/g, ",")}`;
+    default:
+      return `${formatNum(n, 2)} ${currency}`;
+  }
+}
+
+export function escapeHtml(str: string | null | undefined): string {
+  if (!str) return "";
+  return str
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}
+
+/**
+ * Sanitize Quill HTML for the PDF templates: remove dangerous tags, event
+ * handlers, javascript:/data:/vbscript: URLs (href AND src), inline styles,
+ * and merge adjacent identical spans. Runs AFTER DOMPurify at every call site
+ * (regex pass = defense-in-depth, not the primary sanitizer).
+ */
+export function cleanQuillHtml(html: string | null | undefined): string {
+  if (!html) return "";
+  let s = html;
+  // Remove dangerous tags with content
+  s = s.replace(
+    /<(script|iframe|object|embed|style|link|meta|base|form|input|textarea|button|select|svg|math)[^>]*>[\s\S]*?<\/\1>/gi,
+    "",
+  );
+  s = s.replace(
+    /<(script|iframe|object|embed|style|link|meta|base|form|input|textarea|button|select|svg|math)[^>]*\/?>/gi,
+    "",
+  );
+  // Strip event handlers
+  s = s.replace(/\s+on\w+\s*=\s*("[^"]*"|'[^']*'|[^\s>]*)/gi, "");
+  s = s.replace(/\s+on\w+\s*=\s*[^\s>]*/gi, "");
+  // Strip javascript:/data:/vbscript: in href and src
+  s = s.replace(
+    /href\s*=\s*["']?\s*(javascript|data|vbscript)\s*:[^"'>\s]*/gi,
+    'href="#"',
+  );
+  s = s.replace(
+    /src\s*=\s*["']?\s*(javascript|data|vbscript)\s*:[^"'>\s]*/gi,
+    'src=""',
+  );
+  // Replace &nbsp; with regular space (outside of tags)
+  s = s.replace(/(&nbsp;)/g, " ");
+  s = s.replace(/\s+style\s*=\s*("[^"]*"|'[^']*'|[^\s>]*)/gi, "");
+  // Merge adjacent spans with same attributes
+  let prev = "";
+  while (prev !== s) {
+    prev = s;
+    s = s.replace(/<span([^>]*)>(.*?)<\/span>\s*<span\1>/gs, "<span$1>$2");
+  }
+  return s;
+}
+
+/** CSS rules for Quill's .ql-indent-1..9 classes (identical in all templates). */
+export function buildQuillIndentCss(): string {
+  let indentCSS = "";
+  for (let n = 1; n <= 9; n++) {
+    const pad = n * 3;
+    const liPad = n * 3 + 1.5;
+    indentCSS += `  .ql-indent-${n} { padding-left: ${pad}em; }\n`;
+    indentCSS += `  li.ql-indent-${n} { padding-left: ${liPad}em; }\n`;
+  }
+  return indentCSS;
+}