fix: security, validation, and data integrity fixes across 53 files

- Auth: HS256 algorithm restriction on JWT verify, timing-safe bcrypt
  for inactive/locked users, locked_until check in loadAuthData, TOTP
  fixes (async bcrypt, BigInt conversion, future-code counter fix)
- Validation: Zod enums for leave_type/status, numeric transforms on
  foreign keys, VAT 0% coercion fix (Number(v)||21 → v!=null checks)
- Permissions: requirePermission on attendance PUT, attendance_users
  and project_logs access checks, trips users filtered by trips.record
- Prisma queries: fixed roles.is:{OR} pattern (doesn't work on to-one
  relations), attendance_users now filters by attendance.record only
- Transactions: wrapped deleteOrder, createOrder, updateUser, deleteUser,
  duplicateOffer, bulkCreateAttendance, createLeave, scope-templates,
  leave-requests, company-settings, profile updates
- Frontend: mountedRef reset in useListData, blob URL cleanup on unmount,
  null checks on date fields, AdminDatePicker min/max for HH:mm
- Security headers: COOP, CORP, CSP frame-ancestors/form-action/base-uri
- Other: exchange-rate cache TTL, invoice-alert midnight comparison fix,
  numbering.service releaseSequence no-op, nas-offers filename sanitize,
  Content-Disposition header injection fix, mojibake Czech strings

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/services/nas-offers-manager.ts

@@ -32,8 +32,8 @@ class NasOffersManager {
     pdfBuffer: Buffer,
   ): string | null {
     const { prefix, seq } = this.parseParts(quotationNumber);
-    const folderName = `${prefix}_${seq}`;
-    const fileName = `${year}_${prefix}_${seq}.pdf`;
+    const folderName = this.sanitizeFilename(`${prefix}_${seq}`);
+    const fileName = this.sanitizeFilename(`${year}_${prefix}_${seq}`) + ".pdf";
 
     const dir = this.ensureDir(year, folderName);
     if (!dir) return null;
@@ -81,8 +81,8 @@ class NasOffersManager {
   /** Build the relative NAS path for a given quotation number + year */
   buildRelativePath(quotationNumber: string, year: number): string {
     const { prefix, seq } = this.parseParts(quotationNumber);
-    const folderName = `${prefix}_${seq}`;
-    const fileName = `${year}_${prefix}_${seq}.pdf`;
+    const folderName = this.sanitizeFilename(`${prefix}_${seq}`);
+    const fileName = this.sanitizeFilename(`${year}_${prefix}_${seq}`) + ".pdf";
     return `${year}/${folderName}/${fileName}`;
   }
 
@@ -92,8 +92,10 @@ class NasOffersManager {
   } {
     const parts = quotationNumber.split("/");
     return {
-      prefix: parts.length >= 2 ? parts[parts.length - 2] : "NA",
-      seq: parts[parts.length - 1],
+      prefix: this.sanitizeFilename(
+        parts.length >= 2 ? parts[parts.length - 2] : "NA",
+      ),
+      seq: this.sanitizeFilename(parts[parts.length - 1]),
     };
   }