fix: resolve all 28 findings from the 2026-06-12 full audit (TDD-pinned)

Critical (data integrity):
- warehouse inventory confirm: throw (not return) inside $transaction so a
  failed deficit line rolls back the surplus corrective receipt — retries
  no longer accumulate phantom stock
- warehouse issue confirm: validate batches against the COMBINED quantity
  of all lines (duplicate FIFO-resolved lines drove batches negative)
- attendance delete: restore vacation_used/sick_used for the deleted day
  (in-transaction, clamped at 0)

High:
- auth refresh: terminated sessions (replaced_at only) get a plain 401 —
  the theft branch (family revocation) now fires only on replaced_by_hash
- POST /users strips role_id for non-admin callers (mirrors PUT guard)
- issued-order transition flushes unsaved edits via the full save payload
  when dirty; server contract (items+status in one PUT) pinned
- received-invoices list: usePaginatedQuery + pager (rows 26+ unreachable)
- received-invoice dates: nullableIsoDateString + NaN guard before NAS save
  (Czech-format dates corrupted month/year, orphaned NAS files)
- leave approval skips Czech public holidays and books each calendar year's
  hours against its own balance (mirrors createLeave)

Medium/Low (classes):
- 52 Zod caps aligned to DB column widths across 7 schemas (over-cap input
  500ed at Prisma instead of a Czech 400)
- FK pre-validation: projects update + warehouse receipts/issues return
  Czech 400s instead of P2003 500s
- invoice PDF degrades gracefully when the CNB rate is unavailable
  (recap omitted instead of 500 + lost NAS archival)
- date boundaries: local-day filters (warehouse lists/reports, audit-log),
  @db.Date coercion on invoice dates
- plan updateEntry re-checks the per-cell cap (self-excluding)
- {id} tiebreaks on customers/received-invoices/warehouse-items sorts;
  /items honors the client sort param
- htmlToPdf relaunches once when the shared browser died mid-render
- offer number release parses the year from the document number (cross-year
  finalize+delete left permanent sequence gaps)
- trips/vehicles km fields integer-coerced; AI budget regated to
  settings.company|settings.system; Settings System tab no longer clobbers
  Firma numbering patterns; draft invoices hide the dead PDF button;
  dashboard quick-trip invalidates ["vehicles"]; TOTP secret cap 64;
  audit-log + invoice month buckets day-shift fixes

Docs: corrected the stale "Chromium has no CSS margin-box footers" claim
(html-to-pdf.ts + CLAUDE.md — margin boxes render since Chrome 131); audit
report M3 withdrawn accordingly.

~65 new pinning tests; every finding reproduced RED against the real test
DB before its fix. Suite: 58 files / 634 tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/__tests__/attendance-delete-balance.test.ts

@@ -0,0 +1,139 @@
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import prisma from "../config/database";
+import { createLeave, deleteAttendance } from "../services/attendance.service";
+import { localDateStr } from "../utils/date";
+
+/**
+ * Pinning tests for audit finding C1: deleting a vacation/sick attendance
+ * record must restore the hours it charged to leave_balances. Without the
+ * restore, cancelling booked leave by deleting its rows permanently inflates
+ * vacation_used/sick_used.
+ */
+
+const N = "att_delbal_";
+
+let userId: number;
+
+/** First Monday of March in the given year — always before the earliest
+ * possible Easter holiday and clear of all fixed Czech holidays, so a
+ * Mon-Fri range books exactly 5 days. (Far-future year per fixture hygiene.) */
+function firstMondayOfMarch(year: number): Date {
+  const d = new Date(year, 2, 1, 12, 0, 0);
+  while (d.getDay() !== 1) d.setDate(d.getDate() + 1);
+  return d;
+}
+
+async function cleanup() {
+  const users = await prisma.users.findMany({
+    where: { username: { startsWith: N } },
+    select: { id: true },
+  });
+  const ids = users.map((u) => u.id);
+  if (ids.length > 0) {
+    await prisma.attendance.deleteMany({ where: { user_id: { in: ids } } });
+    await prisma.leave_balances.deleteMany({ where: { user_id: { in: ids } } });
+    await prisma.users.deleteMany({ where: { id: { in: ids } } });
+  }
+}
+
+beforeAll(async () => {
+  await cleanup();
+  const adminRole = await prisma.roles.findFirst({ where: { name: "admin" } });
+  if (!adminRole)
+    throw new Error("Admin role not found — seed the database first");
+  const user = await prisma.users.create({
+    data: {
+      username: `${N}user`,
+      email: `${N}user@test.local`,
+      password_hash:
+        "$2a$12$LJ3m4ys3Lg4oLBFnYP2amuPBzJnJBbGzCl5Y6X9Y8r0q5.s3L6OyO",
+      first_name: "Delete",
+      last_name: "Balance",
+      is_active: true,
+      role_id: adminRole.id,
+    },
+  });
+  userId = user.id;
+});
+
+afterAll(async () => {
+  await cleanup();
+  await prisma.$disconnect();
+});
+
+async function balance(year: number) {
+  return prisma.leave_balances.findFirst({ where: { user_id: userId, year } });
+}
+
+describe("deleteAttendance leave-balance restore (audit C1)", () => {
+  it("restores vacation_used when booked vacation rows are deleted", async () => {
+    const monday = firstMondayOfMarch(2098);
+    const friday = new Date(monday);
+    friday.setDate(friday.getDate() + 4);
+
+    const created = await createLeave(
+      {
+        user_id: userId,
+        date_from: localDateStr(monday),
+        date_to: localDateStr(friday),
+        leave_type: "vacation",
+        leave_hours: 8,
+      },
+      userId,
+    );
+    expect("created" in created && created.created).toBe(5);
+    expect(Number((await balance(2098))?.vacation_used)).toBe(40);
+
+    const rows = await prisma.attendance.findMany({
+      where: { user_id: userId, leave_type: "vacation" },
+    });
+    expect(rows).toHaveLength(5);
+    for (const row of rows) {
+      const res = await deleteAttendance(row.id);
+      expect("success" in res && res.success).toBe(true);
+    }
+
+    expect(Number((await balance(2098))?.vacation_used)).toBe(0);
+  });
+
+  it("restores sick_used when a booked sick day is deleted", async () => {
+    const monday = firstMondayOfMarch(2099);
+    await createLeave(
+      {
+        user_id: userId,
+        date_from: localDateStr(monday),
+        leave_type: "sick",
+        leave_hours: 8,
+      },
+      userId,
+    );
+    expect(Number((await balance(2099))?.sick_used)).toBe(8);
+
+    const row = await prisma.attendance.findFirst({
+      where: { user_id: userId, leave_type: "sick" },
+    });
+    expect(row).not.toBeNull();
+    await deleteAttendance(row!.id);
+
+    expect(Number((await balance(2099))?.sick_used)).toBe(0);
+  });
+
+  it("does not touch balances when deleting a plain work shift", async () => {
+    const wednesday = firstMondayOfMarch(2098);
+    wednesday.setDate(wednesday.getDate() + 9); // a weekday a week later
+    const shift = await prisma.attendance.create({
+      data: {
+        user_id: userId,
+        shift_date: wednesday,
+        leave_type: "work",
+      },
+    });
+
+    const before = await balance(2098);
+    await deleteAttendance(shift.id);
+    const after = await balance(2098);
+
+    expect(Number(after?.vacation_used)).toBe(Number(before?.vacation_used));
+    expect(Number(after?.sick_used)).toBe(Number(before?.sick_used));
+  });
+});