fix: security, validation, and data integrity fixes across 53 files

- Auth: HS256 algorithm restriction on JWT verify, timing-safe bcrypt
  for inactive/locked users, locked_until check in loadAuthData, TOTP
  fixes (async bcrypt, BigInt conversion, future-code counter fix)
- Validation: Zod enums for leave_type/status, numeric transforms on
  foreign keys, VAT 0% coercion fix (Number(v)||21 → v!=null checks)
- Permissions: requirePermission on attendance PUT, attendance_users
  and project_logs access checks, trips users filtered by trips.record
- Prisma queries: fixed roles.is:{OR} pattern (doesn't work on to-one
  relations), attendance_users now filters by attendance.record only
- Transactions: wrapped deleteOrder, createOrder, updateUser, deleteUser,
  duplicateOffer, bulkCreateAttendance, createLeave, scope-templates,
  leave-requests, company-settings, profile updates
- Frontend: mountedRef reset in useListData, blob URL cleanup on unmount,
  null checks on date fields, AdminDatePicker min/max for HH:mm
- Security headers: COOP, CORP, CSP frame-ancestors/form-action/base-uri
- Other: exchange-rate cache TTL, invoice-alert midnight comparison fix,
  numbering.service releaseSequence no-op, nas-offers filename sanitize,
  Content-Disposition header injection fix, mojibake Czech strings

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/admin/invoices.ts

@@ -26,10 +26,16 @@ import { nasFinancialsManager } from "../../services/nas-financials-manager";
 export default async function invoicesRoutes(
   fastify: FastifyInstance,
 ): Promise<void> {
-  // Auto-update overdue invoices on GET requests only (matches PHP behavior)
+  // Auto-update overdue invoices on GET requests, throttled to once per hour
+  let lastOverdueCheck = 0;
+  const OVERDUE_CHECK_INTERVAL = 60 * 60 * 1000; // 1 hour
+
   fastify.addHook("onRequest", async (request) => {
     if (request.method !== "GET") return;
-    await markOverdueInvoices();
+    if (Date.now() - lastOverdueCheck > OVERDUE_CHECK_INTERVAL) {
+      lastOverdueCheck = Date.now();
+      await markOverdueInvoices();
+    }
   });
 
   // GET /api/admin/invoices
@@ -226,12 +232,10 @@ export default async function invoicesRoutes(
       const file = nasFinancialsManager.readIssuedInvoice(relPath);
       if (!file) return error(reply, "PDF soubor nenalezen", 404);
 
+      const safeName = invoice.invoice_number.replace(/[\r\n"]/g, "");
       return reply
         .type("application/pdf")
-        .header(
-          "Content-Disposition",
-          `inline; filename="${invoice.invoice_number}.pdf"`,
-        )
+        .header("Content-Disposition", `inline; filename="${safeName}.pdf"`)
         .send(file.data);
     },
   );