fix: security, validation, and data integrity fixes across 53 files

- Auth: HS256 algorithm restriction on JWT verify, timing-safe bcrypt
  for inactive/locked users, locked_until check in loadAuthData, TOTP
  fixes (async bcrypt, BigInt conversion, future-code counter fix)
- Validation: Zod enums for leave_type/status, numeric transforms on
  foreign keys, VAT 0% coercion fix (Number(v)||21 → v!=null checks)
- Permissions: requirePermission on attendance PUT, attendance_users
  and project_logs access checks, trips users filtered by trips.record
- Prisma queries: fixed roles.is:{OR} pattern (doesn't work on to-one
  relations), attendance_users now filters by attendance.record only
- Transactions: wrapped deleteOrder, createOrder, updateUser, deleteUser,
  duplicateOffer, bulkCreateAttendance, createLeave, scope-templates,
  leave-requests, company-settings, profile updates
- Frontend: mountedRef reset in useListData, blob URL cleanup on unmount,
  null checks on date fields, AdminDatePicker min/max for HH:mm
- Security headers: COOP, CORP, CSP frame-ancestors/form-action/base-uri
- Other: exchange-rate cache TTL, invoice-alert midnight comparison fix,
  numbering.service releaseSequence no-op, nas-offers filename sanitize,
  Content-Disposition header injection fix, mojibake Czech strings

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/admin/hooks/useListData.ts

@@ -43,6 +43,7 @@ export default function useListData<T = unknown>(
   const [initialLoad, setInitialLoad] = useState(true);
   const [pagination, setPagination] = useState<PaginationData | null>(null);
   const abortRef = useRef<AbortController | null>(null);
+  const mountedRef = useRef(true);
   const debouncedSearch = useDebounce(search, 300);
 
   const extraParamsKey = Object.entries(extraParams)
@@ -100,8 +101,10 @@ export default function useListData<T = unknown>(
       }
     } catch (err: unknown) {
       if (err instanceof Error && err.name === "AbortError") return;
+      if (!mountedRef.current) return;
       alert.error(errorMsg);
     } finally {
+      if (!mountedRef.current) return;
       setLoading(false);
       setInitialLoad(false);
     }
@@ -117,8 +120,10 @@ export default function useListData<T = unknown>(
   ]);
 
   useEffect(() => {
+    mountedRef.current = true;
     fetchData();
     return () => {
+      mountedRef.current = false;
       if (abortRef.current) abortRef.current.abort();
     };
   }, [fetchData]);