fix: security, validation, and data integrity fixes across 53 files

- Auth: HS256 algorithm restriction on JWT verify, timing-safe bcrypt
  for inactive/locked users, locked_until check in loadAuthData, TOTP
  fixes (async bcrypt, BigInt conversion, future-code counter fix)
- Validation: Zod enums for leave_type/status, numeric transforms on
  foreign keys, VAT 0% coercion fix (Number(v)||21 → v!=null checks)
- Permissions: requirePermission on attendance PUT, attendance_users
  and project_logs access checks, trips users filtered by trips.record
- Prisma queries: fixed roles.is:{OR} pattern (doesn't work on to-one
  relations), attendance_users now filters by attendance.record only
- Transactions: wrapped deleteOrder, createOrder, updateUser, deleteUser,
  duplicateOffer, bulkCreateAttendance, createLeave, scope-templates,
  leave-requests, company-settings, profile updates
- Frontend: mountedRef reset in useListData, blob URL cleanup on unmount,
  null checks on date fields, AdminDatePicker min/max for HH:mm
- Security headers: COOP, CORP, CSP frame-ancestors/form-action/base-uri
- Other: exchange-rate cache TTL, invoice-alert midnight comparison fix,
  numbering.service releaseSequence no-op, nas-offers filename sanitize,
  Content-Disposition header injection fix, mojibake Czech strings

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/admin/project-files.ts

@@ -73,10 +73,11 @@ export default async function projectFilesRoutes(
         if (!result) return error(reply, "Soubor nebyl nalezen", 404);
 
         const stream = fs.createReadStream(result.filePath);
+        const encodedName = encodeURIComponent(result.fileName);
         return reply
           .header(
             "Content-Disposition",
-            `attachment; filename="${encodeURIComponent(result.fileName)}"`,
+            `attachment; filename*=UTF-8''${encodedName}`,
           )
           .header("Content-Type", result.mime)
           .header("X-Content-Type-Options", "nosniff")
@@ -179,7 +180,8 @@ export default async function projectFilesRoutes(
       if (!file) return error(reply, "Nebyl nahrán žádný soubor");
 
       const subPath = parsedQuery.data.path || "";
-      const fileName = file.filename;
+      const rawFileName = file.filename;
+      const fileName = rawFileName.replace(/[\/\\:*?"<>|]/g, "_");
 
       const err = await fm.uploadFile(
         project.project_number,