fix: security, validation, and data integrity fixes across 53 files

- Auth: HS256 algorithm restriction on JWT verify, timing-safe bcrypt
  for inactive/locked users, locked_until check in loadAuthData, TOTP
  fixes (async bcrypt, BigInt conversion, future-code counter fix)
- Validation: Zod enums for leave_type/status, numeric transforms on
  foreign keys, VAT 0% coercion fix (Number(v)||21 → v!=null checks)
- Permissions: requirePermission on attendance PUT, attendance_users
  and project_logs access checks, trips users filtered by trips.record
- Prisma queries: fixed roles.is:{OR} pattern (doesn't work on to-one
  relations), attendance_users now filters by attendance.record only
- Transactions: wrapped deleteOrder, createOrder, updateUser, deleteUser,
  duplicateOffer, bulkCreateAttendance, createLeave, scope-templates,
  leave-requests, company-settings, profile updates
- Frontend: mountedRef reset in useListData, blob URL cleanup on unmount,
  null checks on date fields, AdminDatePicker min/max for HH:mm
- Security headers: COOP, CORP, CSP frame-ancestors/form-action/base-uri
- Other: exchange-rate cache TTL, invoice-alert midnight comparison fix,
  numbering.service releaseSequence no-op, nas-offers filename sanitize,
  Content-Disposition header injection fix, mojibake Czech strings

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/services/invoices.service.ts

@@ -55,8 +55,13 @@ function computeInvoiceTotals(
   const vatAmount = applyVat
     ? items.reduce((s, i) => {
         const base = (Number(i.quantity) || 0) * (Number(i.unit_price) || 0);
-        const vat =
-          base * ((Number(i.vat_rate) || Number(defaultVatRate) || 21) / 100);
+        const vatRate =
+          i.vat_rate != null && i.vat_rate !== ""
+            ? Number(i.vat_rate)
+            : defaultVatRate != null
+              ? Number(defaultVatRate)
+              : 21;
+        const vat = base * (vatRate / 100);
         return s + Math.round(vat * 100) / 100;
       }, 0)
     : 0;
@@ -343,7 +348,7 @@ export async function createInvoice(body: Record<string, any>) {
       customer_id: body.customer_id ? Number(body.customer_id) : null,
       status: body.status ? String(body.status) : "issued",
       currency: body.currency ? String(body.currency) : "CZK",
-      vat_rate: body.vat_rate ? Number(body.vat_rate) : 21.0,
+      vat_rate: body.vat_rate != null ? Number(body.vat_rate) : 21.0,
       apply_vat: body.apply_vat !== false,
       payment_method: body.payment_method ? String(body.payment_method) : null,
       constant_symbol: body.constant_symbol