fix: security, validation, and data integrity fixes across 53 files

- Auth: HS256 algorithm restriction on JWT verify, timing-safe bcrypt
  for inactive/locked users, locked_until check in loadAuthData, TOTP
  fixes (async bcrypt, BigInt conversion, future-code counter fix)
- Validation: Zod enums for leave_type/status, numeric transforms on
  foreign keys, VAT 0% coercion fix (Number(v)||21 → v!=null checks)
- Permissions: requirePermission on attendance PUT, attendance_users
  and project_logs access checks, trips users filtered by trips.record
- Prisma queries: fixed roles.is:{OR} pattern (doesn't work on to-one
  relations), attendance_users now filters by attendance.record only
- Transactions: wrapped deleteOrder, createOrder, updateUser, deleteUser,
  duplicateOffer, bulkCreateAttendance, createLeave, scope-templates,
  leave-requests, company-settings, profile updates
- Frontend: mountedRef reset in useListData, blob URL cleanup on unmount,
  null checks on date fields, AdminDatePicker min/max for HH:mm
- Security headers: COOP, CORP, CSP frame-ancestors/form-action/base-uri
- Other: exchange-rate cache TTL, invoice-alert midnight comparison fix,
  numbering.service releaseSequence no-op, nas-offers filename sanitize,
  Content-Disposition header injection fix, mojibake Czech strings

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/services/exchange-rates.ts

@@ -11,12 +11,17 @@ interface CnbRate {
 }
 
 const rateCache = new Map<string, Record<string, number>>();
+let rateCacheTime = 0;
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 const inflight = new Map<string, Promise<Record<string, number>>>();
 
 async function fetchRatesForDate(
   date?: string,
 ): Promise<Record<string, number>> {
   const key = date || "today";
+  if (Date.now() - rateCacheTime > CACHE_TTL_MS) {
+    rateCache.clear();
+  }
   if (rateCache.has(key)) return rateCache.get(key)!;
   if (inflight.has(key)) return inflight.get(key)!;
 
@@ -36,6 +41,7 @@ async function fetchRatesForDate(
       }
 
       rateCache.set(key, rates);
+      rateCacheTime = Date.now();
       return rates;
     } catch (err) {
       console.error("Failed to fetch CNB exchange rates:", err);