fix: security, validation, and data integrity fixes across 53 files

- Auth: HS256 algorithm restriction on JWT verify, timing-safe bcrypt
  for inactive/locked users, locked_until check in loadAuthData, TOTP
  fixes (async bcrypt, BigInt conversion, future-code counter fix)
- Validation: Zod enums for leave_type/status, numeric transforms on
  foreign keys, VAT 0% coercion fix (Number(v)||21 → v!=null checks)
- Permissions: requirePermission on attendance PUT, attendance_users
  and project_logs access checks, trips users filtered by trips.record
- Prisma queries: fixed roles.is:{OR} pattern (doesn't work on to-one
  relations), attendance_users now filters by attendance.record only
- Transactions: wrapped deleteOrder, createOrder, updateUser, deleteUser,
  duplicateOffer, bulkCreateAttendance, createLeave, scope-templates,
  leave-requests, company-settings, profile updates
- Frontend: mountedRef reset in useListData, blob URL cleanup on unmount,
  null checks on date fields, AdminDatePicker min/max for HH:mm
- Security headers: COOP, CORP, CSP frame-ancestors/form-action/base-uri
- Other: exchange-rate cache TTL, invoice-alert midnight comparison fix,
  numbering.service releaseSequence no-op, nas-offers filename sanitize,
  Content-Disposition header injection fix, mojibake Czech strings

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/schemas/invoices.schema.ts

@@ -4,13 +4,21 @@ const InvoiceItemSchema = z.object({
   description: z.string().nullish(),
   quantity: z
     .union([z.number(), z.string()])
-    .transform((v) => Number(v) || 1)
+    .transform((v) => {
+      const n = Number(v);
+      if (isNaN(n) || n <= 0) throw new Error("Invalid quantity");
+      return n;
+    })
     .optional()
     .default(1),
   unit: z.string().nullish(),
   unit_price: z
     .union([z.number(), z.string()])
-    .transform((v) => Number(v) || 0)
+    .transform((v) => {
+      const n = Number(v);
+      if (isNaN(n)) throw new Error("Invalid unit_price");
+      return n;
+    })
     .optional()
     .default(0),
   vat_rate: z
@@ -73,7 +81,10 @@ export const UpdateInvoiceSchema = z.object({
   bank_iban: z.string().nullish(),
   bank_account: z.string().nullish(),
   issued_by: z.string().nullish(),
-  customer_id: z.union([z.number(), z.string(), z.null()]).optional(),
+  customer_id: z
+    .union([z.number(), z.string(), z.null()])
+    .transform((v) => (v === null ? null : Number(v)))
+    .optional(),
   vat_rate: z
     .union([z.number(), z.string()])
     .transform((v) => Number(v))