fix: resolve all 28 findings from the 2026-06-12 full audit (TDD-pinned)

Critical (data integrity):
- warehouse inventory confirm: throw (not return) inside $transaction so a
  failed deficit line rolls back the surplus corrective receipt — retries
  no longer accumulate phantom stock
- warehouse issue confirm: validate batches against the COMBINED quantity
  of all lines (duplicate FIFO-resolved lines drove batches negative)
- attendance delete: restore vacation_used/sick_used for the deleted day
  (in-transaction, clamped at 0)

High:
- auth refresh: terminated sessions (replaced_at only) get a plain 401 —
  the theft branch (family revocation) now fires only on replaced_by_hash
- POST /users strips role_id for non-admin callers (mirrors PUT guard)
- issued-order transition flushes unsaved edits via the full save payload
  when dirty; server contract (items+status in one PUT) pinned
- received-invoices list: usePaginatedQuery + pager (rows 26+ unreachable)
- received-invoice dates: nullableIsoDateString + NaN guard before NAS save
  (Czech-format dates corrupted month/year, orphaned NAS files)
- leave approval skips Czech public holidays and books each calendar year's
  hours against its own balance (mirrors createLeave)

Medium/Low (classes):
- 52 Zod caps aligned to DB column widths across 7 schemas (over-cap input
  500ed at Prisma instead of a Czech 400)
- FK pre-validation: projects update + warehouse receipts/issues return
  Czech 400s instead of P2003 500s
- invoice PDF degrades gracefully when the CNB rate is unavailable
  (recap omitted instead of 500 + lost NAS archival)
- date boundaries: local-day filters (warehouse lists/reports, audit-log),
  @db.Date coercion on invoice dates
- plan updateEntry re-checks the per-cell cap (self-excluding)
- {id} tiebreaks on customers/received-invoices/warehouse-items sorts;
  /items honors the client sort param
- htmlToPdf relaunches once when the shared browser died mid-render
- offer number release parses the year from the document number (cross-year
  finalize+delete left permanent sequence gaps)
- trips/vehicles km fields integer-coerced; AI budget regated to
  settings.company|settings.system; Settings System tab no longer clobbers
  Firma numbering patterns; draft invoices hide the dead PDF button;
  dashboard quick-trip invalidates ["vehicles"]; TOTP secret cap 64;
  audit-log + invoice month buckets day-shift fixes

Docs: corrected the stale "Chromium has no CSS margin-box footers" claim
(html-to-pdf.ts + CLAUDE.md — margin boxes render since Chrome 131); audit
report M3 withdrawn accordingly.

~65 new pinning tests; every finding reproduced RED against the real test
DB before its fix. Suite: 58 files / 634 tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/schemas/invoices.schema.ts

@@ -6,39 +6,40 @@ import {
   positiveNumberFromForm,
   nullableIntIdFromForm,
   booleanFromForm,
+  nullableIsoDateString,
   DocumentSectionSchema,
 } from "./common";
 
 const InvoiceItemSchema = z.object({
-  description: z.string().max(8000).nullish(),
+  description: z.string().max(500).nullish(),
   item_description: z.string().max(8000).nullish(),
   quantity: positiveNumberFromForm.default(1),
-  unit: z.string().max(255).nullish(),
+  unit: z.string().max(20).nullish(),
   unit_price: numberFromForm.default(0),
   vat_rate: numberInRange(0, 100).optional().default(21.0),
   position: nonNegativeNumberFromForm.optional(),
 });
 
 export const CreateInvoiceSchema = z.object({
-  invoice_number: z.string().max(255).nullish(),
+  invoice_number: z.string().max(50).nullish(),
   order_id: nullableIntIdFromForm.nullish(),
   customer_id: nullableIntIdFromForm.nullish(),
   status: z.string().max(20).optional().default("draft"),
-  currency: z.string().max(20).optional().default("CZK"),
+  currency: z.string().max(10).optional().default("CZK"),
   vat_rate: numberInRange(0, 100).optional().default(21.0),
   apply_vat: booleanFromForm.optional().default(true),
-  payment_method: z.string().max(255).nullish(),
-  constant_symbol: z.string().max(255).nullish(),
+  payment_method: z.string().max(50).nullish(),
+  constant_symbol: z.string().max(20).nullish(),
   bank_name: z.string().max(255).nullish(),
-  bank_swift: z.string().max(255).nullish(),
-  bank_iban: z.string().max(255).nullish(),
-  bank_account: z.string().max(255).nullish(),
-  issue_date: z.string().max(255).nullish(),
-  due_date: z.string().max(255).nullish(),
-  tax_date: z.string().max(255).nullish(),
+  bank_swift: z.string().max(20).nullish(),
+  bank_iban: z.string().max(50).nullish(),
+  bank_account: z.string().max(50).nullish(),
+  issue_date: nullableIsoDateString,
+  due_date: nullableIsoDateString,
+  tax_date: nullableIsoDateString,
   issued_by: z.string().max(255).nullish(),
-  billing_text: z.string().max(8000).nullish(),
-  language: z.string().max(20).optional().default("cs"),
+  billing_text: z.string().max(500).nullish(),
+  language: z.string().max(5).optional().default("cs"),
   // `notes` was dropped (printed-notes block removed — free-form PDF content
   // lives in the sections); legacy clients still sending it are silently
   // stripped by z.object. internal_notes is never printed.
@@ -51,24 +52,24 @@ export const CreateInvoiceSchema = z.object({
 
 export const UpdateInvoiceSchema = z.object({
   status: z.string().max(20).optional(),
-  currency: z.string().max(20).optional(),
-  language: z.string().max(20).optional(),
-  payment_method: z.string().max(255).nullish(),
-  constant_symbol: z.string().max(255).nullish(),
+  currency: z.string().max(10).optional(),
+  language: z.string().max(5).optional(),
+  payment_method: z.string().max(50).nullish(),
+  constant_symbol: z.string().max(20).nullish(),
   bank_name: z.string().max(255).nullish(),
-  bank_swift: z.string().max(255).nullish(),
-  bank_iban: z.string().max(255).nullish(),
-  bank_account: z.string().max(255).nullish(),
+  bank_swift: z.string().max(20).nullish(),
+  bank_iban: z.string().max(50).nullish(),
+  bank_account: z.string().max(50).nullish(),
   issued_by: z.string().max(255).nullish(),
-  billing_text: z.string().max(8000).nullish(),
+  billing_text: z.string().max(500).nullish(),
   customer_id: nullableIntIdFromForm.optional(),
   vat_rate: numberInRange(0, 100).optional(),
   apply_vat: booleanFromForm.optional(),
-  issue_date: z.union([z.string().max(255), z.null()]).optional(),
-  due_date: z.union([z.string().max(255), z.null()]).optional(),
-  tax_date: z.union([z.string().max(255), z.null()]).optional(),
+  issue_date: nullableIsoDateString,
+  due_date: nullableIsoDateString,
+  tax_date: nullableIsoDateString,
   internal_notes: z.string().max(8000).nullish(),
-  paid_date: z.union([z.string().max(255), z.null()]).optional(),
+  paid_date: nullableIsoDateString,
   items: z.array(InvoiceItemSchema).optional(),
   sections: z.array(DocumentSectionSchema).optional(),
 });