fix: security, validation, and data integrity fixes across 53 files

- Auth: HS256 algorithm restriction on JWT verify, timing-safe bcrypt
  for inactive/locked users, locked_until check in loadAuthData, TOTP
  fixes (async bcrypt, BigInt conversion, future-code counter fix)
- Validation: Zod enums for leave_type/status, numeric transforms on
  foreign keys, VAT 0% coercion fix (Number(v)||21 → v!=null checks)
- Permissions: requirePermission on attendance PUT, attendance_users
  and project_logs access checks, trips users filtered by trips.record
- Prisma queries: fixed roles.is:{OR} pattern (doesn't work on to-one
  relations), attendance_users now filters by attendance.record only
- Transactions: wrapped deleteOrder, createOrder, updateUser, deleteUser,
  duplicateOffer, bulkCreateAttendance, createLeave, scope-templates,
  leave-requests, company-settings, profile updates
- Frontend: mountedRef reset in useListData, blob URL cleanup on unmount,
  null checks on date fields, AdminDatePicker min/max for HH:mm
- Security headers: COOP, CORP, CSP frame-ancestors/form-action/base-uri
- Other: exchange-rate cache TTL, invoice-alert midnight comparison fix,
  numbering.service releaseSequence no-op, nas-offers filename sanitize,
  Content-Disposition header injection fix, mojibake Czech strings

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/admin/pages/Attendance.tsx

@@ -634,7 +634,8 @@ export default function Attendance() {
                     {projectLogs.length > 0 && (
                       <div className="attendance-project-logs">
                         {projectLogs.map((log, i) => {
-                          const start = new Date(log.started_at!);
+                          if (!log.started_at) return null;
+                          const start = new Date(log.started_at);
                           const end = log.ended_at
                             ? new Date(log.ended_at)
                             : new Date();
@@ -786,11 +787,12 @@ export default function Attendance() {
                                     }}
                                   >
                                     {shiftLogs.map((log, i) => {
+                                      if (!log.started_at) return null;
                                       const mins = log.ended_at
                                         ? Math.floor(
                                             (new Date(log.ended_at).getTime() -
                                               new Date(
-                                                log.started_at!,
+                                                log.started_at,
                                               ).getTime()) /
                                               60000,
                                           )