fix: resolve all 28 findings from the 2026-06-12 full audit (TDD-pinned)

Critical (data integrity):
- warehouse inventory confirm: throw (not return) inside $transaction so a
  failed deficit line rolls back the surplus corrective receipt — retries
  no longer accumulate phantom stock
- warehouse issue confirm: validate batches against the COMBINED quantity
  of all lines (duplicate FIFO-resolved lines drove batches negative)
- attendance delete: restore vacation_used/sick_used for the deleted day
  (in-transaction, clamped at 0)

High:
- auth refresh: terminated sessions (replaced_at only) get a plain 401 —
  the theft branch (family revocation) now fires only on replaced_by_hash
- POST /users strips role_id for non-admin callers (mirrors PUT guard)
- issued-order transition flushes unsaved edits via the full save payload
  when dirty; server contract (items+status in one PUT) pinned
- received-invoices list: usePaginatedQuery + pager (rows 26+ unreachable)
- received-invoice dates: nullableIsoDateString + NaN guard before NAS save
  (Czech-format dates corrupted month/year, orphaned NAS files)
- leave approval skips Czech public holidays and books each calendar year's
  hours against its own balance (mirrors createLeave)

Medium/Low (classes):
- 52 Zod caps aligned to DB column widths across 7 schemas (over-cap input
  500ed at Prisma instead of a Czech 400)
- FK pre-validation: projects update + warehouse receipts/issues return
  Czech 400s instead of P2003 500s
- invoice PDF degrades gracefully when the CNB rate is unavailable
  (recap omitted instead of 500 + lost NAS archival)
- date boundaries: local-day filters (warehouse lists/reports, audit-log),
  @db.Date coercion on invoice dates
- plan updateEntry re-checks the per-cell cap (self-excluding)
- {id} tiebreaks on customers/received-invoices/warehouse-items sorts;
  /items honors the client sort param
- htmlToPdf relaunches once when the shared browser died mid-render
- offer number release parses the year from the document number (cross-year
  finalize+delete left permanent sequence gaps)
- trips/vehicles km fields integer-coerced; AI budget regated to
  settings.company|settings.system; Settings System tab no longer clobbers
  Firma numbering patterns; draft invoices hide the dead PDF button;
  dashboard quick-trip invalidates ["vehicles"]; TOTP secret cap 64;
  audit-log + invoice month buckets day-shift fixes

Docs: corrected the stale "Chromium has no CSS margin-box footers" claim
(html-to-pdf.ts + CLAUDE.md — margin boxes render since Chrome 131); audit
report M3 withdrawn accordingly.

~65 new pinning tests; every finding reproduced RED against the real test
DB before its fix. Suite: 58 files / 634 tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/routes/admin/invoices-pdf.ts

@@ -408,7 +408,22 @@ export default async function invoicesPdfRoutes(
         const issueDateStr = invoice.issue_date
           ? localDateStr(new Date(invoice.issue_date))
           : undefined;
-        const cnbRate = isForeign ? await getRate(currency, issueDateStr) : 1.0;
+        // CNB may be unreachable (or the issue date never cached). The rate
+        // only feeds the CZK recap + conversion footnote — degrade by
+        // omitting them (cnbRate = null) rather than failing the whole
+        // render AND the NAS archival (expected condition, logged).
+        let cnbRate: number | null = 1.0;
+        if (isForeign) {
+          try {
+            cnbRate = await getRate(currency, issueDateStr);
+          } catch (err) {
+            console.error(
+              `[invoices-pdf] Kurz ČNB nedostupný pro ${currency} — rekapitulace v Kč vynechána`,
+              err,
+            );
+            cnbRate = null;
+          }
+        }
         const vatRates = [21, 12, 0];
         const vatRecap: Array<{
           rate: number;
@@ -416,16 +431,18 @@ export default async function invoicesPdfRoutes(
           vat: number;
           total: number;
         }> = [];
-        for (const rate of vatRates) {
-          const key = String(rate);
-          const base = vatSummary[key]?.base ?? 0;
-          const vat = vatSummary[key]?.vat ?? 0;
-          vatRecap.push({
-            rate,
-            base: Math.round(base * cnbRate * 100) / 100,
-            vat: Math.round(vat * cnbRate * 100) / 100,
-            total: Math.round((base + vat) * cnbRate * 100) / 100,
-          });
+        if (cnbRate !== null) {
+          for (const rate of vatRates) {
+            const key = String(rate);
+            const base = vatSummary[key]?.base ?? 0;
+            const vat = vatSummary[key]?.vat ?? 0;
+            vatRecap.push({
+              rate,
+              base: Math.round(base * cnbRate * 100) / 100,
+              vat: Math.round(vat * cnbRate * 100) / 100,
+              total: Math.round((base + vat) * cnbRate * 100) / 100,
+            });
+          }
         }
 
         const supp = buildAddressLines(settings, true, t);
@@ -503,6 +520,39 @@ export default async function invoicesPdfRoutes(
           )
           .join("");
 
+        // CNB rate unavailable → the CZK figures cannot be computed; omit
+        // the whole recap table (the payment QR next to it stays).
+        const recapTableHtml =
+          cnbRate === null
+            ? ""
+            : `<table>
+      <thead>
+        <tr>
+          <th colspan="4">${escapeHtml(t.vat_recap)}</th>
+        </tr>
+        <tr>
+          <th>${escapeHtml(t.vat_base)}</th>
+          <th>${escapeHtml(t.vat_rate)}</th>
+          <th>${escapeHtml(t.vat_amount)}</th>
+          <th>${escapeHtml(t.vat_with_total)}</th>
+        </tr>
+      </thead>
+      <tbody>
+        ${vatRecapHtml}
+      </tbody>
+      ${
+        isForeign
+          ? `<tfoot>
+        <tr>
+          <td colspan="4" style="font-size:0.7em; color:#666; padding-top:6px; text-align:left;">
+            ${escapeHtml(t.cnb_rate)} ${formatDate(invoice.issue_date)}: 1 ${escapeHtml(currency)} = ${cnbRate.toFixed(3).replace(".", ",")} CZK
+          </td>
+        </tr>
+      </tfoot>`
+          : ""
+      }
+    </table>`;
+
         let vatDetailHtml = "";
         if (applyVat) {
           for (const [rate, data] of Object.entries(vatSummary)) {
@@ -1050,33 +1100,7 @@ ${indentCSS}
     <div class="qr">
       ${qrSvg}
     </div>
-    <table>
-      <thead>
-        <tr>
-          <th colspan="4">${escapeHtml(t.vat_recap)}</th>
-        </tr>
-        <tr>
-          <th>${escapeHtml(t.vat_base)}</th>
-          <th>${escapeHtml(t.vat_rate)}</th>
-          <th>${escapeHtml(t.vat_amount)}</th>
-          <th>${escapeHtml(t.vat_with_total)}</th>
-        </tr>
-      </thead>
-      <tbody>
-        ${vatRecapHtml}
-      </tbody>
-      ${
-        isForeign
-          ? `<tfoot>
-        <tr>
-          <td colspan="4" style="font-size:0.7em; color:#666; padding-top:6px; text-align:left;">
-            ${escapeHtml(t.cnb_rate)} ${formatDate(invoice.issue_date)}: 1 ${escapeHtml(currency)} = ${cnbRate.toFixed(3).replace(".", ",")} CZK
-          </td>
-        </tr>
-      </tfoot>`
-          : ""
-      }
-    </table>
+    ${recapTableHtml}
   </div>
 
   <!-- Prevzal / razitko -->