fix: security, validation, and data integrity fixes across 53 files

- Auth: HS256 algorithm restriction on JWT verify, timing-safe bcrypt
  for inactive/locked users, locked_until check in loadAuthData, TOTP
  fixes (async bcrypt, BigInt conversion, future-code counter fix)
- Validation: Zod enums for leave_type/status, numeric transforms on
  foreign keys, VAT 0% coercion fix (Number(v)||21 → v!=null checks)
- Permissions: requirePermission on attendance PUT, attendance_users
  and project_logs access checks, trips users filtered by trips.record
- Prisma queries: fixed roles.is:{OR} pattern (doesn't work on to-one
  relations), attendance_users now filters by attendance.record only
- Transactions: wrapped deleteOrder, createOrder, updateUser, deleteUser,
  duplicateOffer, bulkCreateAttendance, createLeave, scope-templates,
  leave-requests, company-settings, profile updates
- Frontend: mountedRef reset in useListData, blob URL cleanup on unmount,
  null checks on date fields, AdminDatePicker min/max for HH:mm
- Security headers: COOP, CORP, CSP frame-ancestors/form-action/base-uri
- Other: exchange-rate cache TTL, invoice-alert midnight comparison fix,
  numbering.service releaseSequence no-op, nas-offers filename sanitize,
  Content-Disposition header injection fix, mojibake Czech strings

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/admin/pages/OrderDetail.tsx

@@ -3,6 +3,7 @@ import {
   useEffect,
   useCallback,
   useMemo,
+  useRef,
   type ReactNode,
 } from "react";
 import DOMPurify from "dompurify";
@@ -121,6 +122,13 @@ export default function OrderDetail() {
   const [confirmationLoading, setConfirmationLoading] = useState(false);
   const initialNotesRef = useRef<string | null>(null);
   const hasSetInitialSnapshot = useRef(false);
+  const blobTimeoutsRef = useRef<ReturnType<typeof setTimeout>[]>([]);
+
+  useEffect(() => {
+    return () => {
+      blobTimeoutsRef.current.forEach(clearTimeout);
+    };
+  }, []);
 
   const fetchDetail = useCallback(async () => {
     try {
@@ -249,7 +257,8 @@ export default function OrderDetail() {
       const blob = await response.blob();
       const url = URL.createObjectURL(blob);
       if (newWindow) newWindow.location.href = url;
-      setTimeout(() => URL.revokeObjectURL(url), 60000);
+      const timeoutId = setTimeout(() => URL.revokeObjectURL(url), 60000);
+      blobTimeoutsRef.current.push(timeoutId);
     } catch {
       newWindow?.close();
       alert.error("Chyba připojení");
@@ -293,7 +302,8 @@ export default function OrderDetail() {
       document.body.appendChild(a);
       a.click();
       document.body.removeChild(a);
-      setTimeout(() => URL.revokeObjectURL(url), 60000);
+      const timeoutId = setTimeout(() => URL.revokeObjectURL(url), 60000);
+      blobTimeoutsRef.current.push(timeoutId);
     } catch {
       alert.error("Chyba připojení");
     } finally {