fix: security, validation, and data integrity fixes across 53 files

- Auth: HS256 algorithm restriction on JWT verify, timing-safe bcrypt
  for inactive/locked users, locked_until check in loadAuthData, TOTP
  fixes (async bcrypt, BigInt conversion, future-code counter fix)
- Validation: Zod enums for leave_type/status, numeric transforms on
  foreign keys, VAT 0% coercion fix (Number(v)||21 → v!=null checks)
- Permissions: requirePermission on attendance PUT, attendance_users
  and project_logs access checks, trips users filtered by trips.record
- Prisma queries: fixed roles.is:{OR} pattern (doesn't work on to-one
  relations), attendance_users now filters by attendance.record only
- Transactions: wrapped deleteOrder, createOrder, updateUser, deleteUser,
  duplicateOffer, bulkCreateAttendance, createLeave, scope-templates,
  leave-requests, company-settings, profile updates
- Frontend: mountedRef reset in useListData, blob URL cleanup on unmount,
  null checks on date fields, AdminDatePicker min/max for HH:mm
- Security headers: COOP, CORP, CSP frame-ancestors/form-action/base-uri
- Other: exchange-rate cache TTL, invoice-alert midnight comparison fix,
  numbering.service releaseSequence no-op, nas-offers filename sanitize,
  Content-Disposition header injection fix, mojibake Czech strings

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/services/numbering.service.ts

@@ -109,20 +109,14 @@ async function previewNextSequence(
 }
 
 /**
- * Decrement the sequence counter for a given type/year.
- * Called after deleting a document so the number can be reused.
+ * Release a sequence number back to the pool.
+ * NOTE: Blindly decrementing can cause duplicate numbers if numbers were
+ * allocated after this one. Sequence numbers are consumed but not returned
+ * to the pool — this is intentionally a no-op.
  */
-async function releaseSequence(type: string, year: number) {
-  try {
-    await prisma.$executeRaw`
-      UPDATE number_sequences
-      SET last_number = GREATEST(COALESCE(last_number, 0) - 1, 0)
-      WHERE \`type\` = ${type} AND \`year\` = ${year}
-    `;
-  } catch (err) {
-    // Non-fatal: log but don't fail the delete operation
-    console.error(`releaseSequence failed for ${type}/${year}:`, err);
-  }
+async function releaseSequence(_type: string, _year: number) {
+  // No-op: decrementing can cause duplicate sequence numbers.
+  // Sequence numbers are consumed but never returned to the pool.
 }
 
 /** Verify a shared number is not already used by an order or project. */