1.5.3

- feat: manual VAT override in order confirmation modal
- feat: order confirmation PDF respects user-selected applyVat toggle

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitignore

@@ -6,3 +6,10 @@ dist/
 *.log
 dist-client/
 *.css.map
+
+# Release archives
+*.tar.gz
+
+# Claude worktrees
+.claude/worktrees/
+.claude/settings.local.json

CLAUDE.md

@@ -0,0 +1,295 @@
+# CLAUDE.md — boha-app-ts
+
+Business management system for a Czech company, rewritten from PHP to TypeScript/Node.js.
+Handles attendance, invoicing, leave/trips, projects, vehicles, and HR operations.
+
+---
+
+## Tech Stack
+
+| Layer          | Technology                                                    |
+| -------------- | ------------------------------------------------------------- |
+| Runtime        | Node.js, TypeScript 5.9.3 (strict)                            |
+| HTTP Framework | Fastify 5.8.2                                                 |
+| ORM            | Prisma 6.19.2 → MySQL                                         |
+| Auth           | JWT (HS256, 15 min) + TOTP 2FA (RFC 6238, otpauth) + bcryptjs |
+| Validation     | Zod 4.3.6                                                     |
+| Frontend       | React 18.3.1 + Vite 8.0.0                                     |
+| Testing        | Vitest 4.1.0 + Supertest                                      |
+| PDF            | Puppeteer 24.x                                                |
+| Email          | nodemailer 8.x                                                |
+| Cron           | node-cron 4.x                                                 |
+
+---
+
+## Project Structure
+
+```
+src/
+├── server.ts           # Fastify server entry point — plugins, routes, error handler
+├── routes/admin/       # HTTP route handlers (one file per entity)
+├── services/           # Business logic (no classes, exported functions, uses Prisma directly)
+├── schemas/            # Zod validation schemas (one file per entity)
+├── middleware/         # auth.ts (requireAuth, requirePermission, optionalAuth)
+│                       # security.ts (CSP, HSTS, security headers)
+├── utils/              # totp.ts, pdf.ts, email.ts, audit.ts, formatters, etc.
+├── config/             # env.ts (config singleton, Date.toJSON override)
+├── types/              # index.ts (AuthData, JwtPayload, ApiResponse, re-exports from Prisma)
+├── admin/              # React 18 frontend (56 .tsx files)
+│   ├── AdminApp.tsx    # Router + lazy-loaded pages
+│   ├── contexts/       # AuthContext, AlertContext
+│   ├── components/     # Layout, modals, tables, editors
+│   ├── pages/          # One file per page/feature
+│   ├── hooks/          # useApiCall, useListData, useTableSort, etc.
+│   └── utils/          # api.ts (fetch wrapper with token refresh), formatters, helpers
+└── __tests__/          # Vitest tests (auth, numbering)
+
+prisma/
+├── schema.prisma       # 32 models, MySQL, snake_case columns
+└── migrations/         # Applied migrations
+
+dist/                   # Compiled server (CommonJS, ES2022)
+dist-client/            # Built frontend (Vite, ES2020)
+```
+
+---
+
+## Commands
+
+```bash
+# Development
+npm run dev             # Starts server in watch mode (manage frontend separately)
+npm run dev:server      # tsx watch src/server.ts
+npm run dev:client      # Vite dev server
+
+# Build
+npm run build           # Build server + client
+npm run build:server    # tsc -p tsconfig.server.json → dist/
+npm run build:client    # vite build → dist-client/
+
+# Run (production)
+npm start               # node dist/server.js
+
+# Tests
+npm test                # vitest run (single pass)
+npm run test:watch      # vitest watch
+
+# Database
+npx prisma migrate dev          # Apply migrations (dev)
+npx prisma migrate deploy       # Apply migrations (prod)
+npx prisma generate             # Regenerate Prisma client after schema changes
+npx prisma studio               # DB browser GUI
+```
+
+**Do not start the dev server.** The user manages it separately.
+
+---
+
+## Environment Variables
+
+Required:
+
+```
+DATABASE_URL=mysql://user:pass@host:3306/dbname
+JWT_SECRET=<64-char hex string>
+TOTP_ENCRYPTION_KEY=<64-char hex string>
+```
+
+Optional (with defaults):
+
+```
+PORT=3001                          # Production port (dev default: 3000)
+HOST=127.0.0.1
+APP_ENV=local|production           # Default: local. Controls CSP, CORS, HSTS
+ACCESS_TOKEN_EXPIRY=900            # 15 minutes
+REFRESH_TOKEN_SESSION_EXPIRY=3600  # 1 hour
+REFRESH_TOKEN_REMEMBER_EXPIRY=2592000  # 30 days
+NAS_PATH=Z:/02_PROJEKTY            # Network share for project files
+MAX_UPLOAD_SIZE=52428800           # 50MB
+CONTACT_EMAIL_TO=
+CONTACT_EMAIL_FROM=
+SMTP_FROM=
+LEAVE_NOTIFY_EMAIL=
+APP_URL=                           # Used in email links
+CORS_ORIGINS=                      # Comma-separated, production only
+```
+
+Use `.env` for dev, `.env.test` for tests.
+
+---
+
+## Architecture & Key Patterns
+
+### Request Flow
+
+```
+Request → CORS → Cookie → Rate-limit → Security headers
+       → requirePermission() or requireAuth()
+       → Zod schema validation (parseBody helper)
+       → Route handler
+       → Service function
+       → Prisma
+       → success(reply, data) or error(reply, message, status)
+```
+
+### Response Format
+
+All responses use this shape:
+
+```typescript
+// Success
+{ success: true, data: T, message?: string, pagination?: {...} }
+
+// Error
+{ success: false, error: string }
+```
+
+Use the `success()` and `error()` helpers in routes — never write raw `reply.send()`.
+
+### Service Pattern
+
+Services are plain exported async functions, no classes:
+
+```typescript
+// src/services/foo.service.ts
+export async function getFoo(id: number) {
+  const result = await prisma.foo.findUnique({ where: { id } });
+  if (!result) return { error: "Not found", status: 404 };
+  return { data: result };
+}
+
+// src/routes/admin/foo.ts
+const result = await getFoo(id);
+if ("error" in result) return error(reply, result.error, result.status ?? 400);
+return success(reply, result.data);
+```
+
+### Error Handling
+
+- Routes map service errors to HTTP responses using the pattern above.
+- Global error handler in `server.ts` catches all unhandled exceptions; returns 500 with Czech message.
+- **Never silently swallow errors.** Even if a failure is non-fatal, log it: `app.log.error(e, 'context')`.
+- Error messages are in Czech (this is intentional — user-facing messages, Czech company).
+
+### Permissions
+
+```typescript
+// Route-level guard
+fastify.addHook("preHandler", requirePermission("invoices.view"));
+// or multiple
+fastify.addHook(
+  "preHandler",
+  requirePermission("invoices.view", "invoices.edit"),
+);
+
+// Admin role bypasses all permission checks
+// Permissions follow the pattern: "entity.action" (e.g., "users.create", "invoices.delete")
+```
+
+### Audit Logging
+
+Call `logAudit()` from `src/utils/audit.ts` whenever data is created/updated/deleted.
+Pass `oldData` and `newData` so the diff is stored. Audit failures are non-fatal.
+
+### Validation
+
+Use Zod schemas from `src/schemas/`. All route bodies must be validated:
+
+```typescript
+const body = parseBody(FooSchema, request.body);
+if ("error" in body) return error(reply, body.error, 400);
+```
+
+---
+
+## Date & Timezone Handling (Critical Gotcha)
+
+`src/config/env.ts` sets `process.env.TZ = 'Europe/Prague'` and overrides
+`Date.prototype.toJSON()` to return local time (not UTC). This means:
+
+- `JSON.stringify(new Date())` returns local Czech time, not UTC.
+- All API responses with Date fields will contain local time strings.
+- Prisma stores dates as UTC internally, but they read back as local due to the TZ setting.
+- **Never assume UTC** when working with Date objects in this codebase.
+- When writing new date comparisons or DB queries, use `new Date()` (already local) — do not manually offset.
+- The override exists for PHP migration compatibility and Czech date display.
+
+---
+
+## TOTP / 2FA
+
+- Secret stored AES-256-GCM encrypted in `users.totp_secret`.
+- Supports two encoding formats: PHP legacy (base64 iv+cipher+tag) and TS (hex).
+- Backup codes stored as encrypted JSON array in `users.totp_backup_codes`.
+- When `company_settings.require_2fa = true`, all users must enroll before accessing the app.
+- Login flow: password → if 2FA enabled → issue `loginToken` (5 min, single-use) → TOTP verify → issue access + refresh tokens.
+
+---
+
+## Testing
+
+Tests live in `src/__tests__/`. They use Vitest + Supertest against a real test database (`.env.test`).
+
+- Test coverage is minimal: only `auth` and `numbering` are tested.
+- Use `buildApp()` helper to spin up the Fastify instance for tests.
+- Tests use `vitest.config.ts` with `environment: 'node'` and 15s timeout.
+- **Do not mock Prisma** — tests hit a real database to catch schema/query bugs.
+
+When adding new features, add tests in `src/__tests__/`. Name test files `<feature>.test.ts`.
+
+---
+
+## Frontend Conventions
+
+- Pages are lazy-loaded via `React.lazy()` in `AdminApp.tsx`.
+- Auth state lives in `AuthContext`; use `useAuth()` hook to access it.
+- Alerts/toasts use `AlertContext`; use `useAlert()` to show them.
+- API calls go through `src/admin/utils/api.ts` which handles token refresh automatically (deduplicates concurrent refresh calls).
+- Custom hooks: `useApiCall`, `useListData`, `useTableSort`, `useDebounce`, `useModalLock`.
+- Styling: CSS files in `src/admin/` — no CSS-in-JS, no Tailwind. Use CSS variables.
+
+---
+
+## Database Conventions
+
+- All models use `snake_case` column names; Prisma maps to camelCase in TypeScript.
+- Soft-delete via `is_deleted` boolean (not all tables, check schema).
+- Timestamps: `created_at`, `updated_at` (auto-managed by Prisma).
+- Number sequences (`number_sequences` table) manage invoice/quotation numbering — never hardcode numbering logic.
+- All significant tables have audit log entries. Check `audit_logs` model for the schema.
+
+---
+
+## Known Issues & Gotchas
+
+1. **Date.prototype.toJSON override** — global monkey-patch in `src/config/env.ts`. Side-effects on third-party libraries that serialize dates. Do not remove without migrating all date serialization.
+
+2. **CJS/ESM mismatch in tests** — Server compiles to CommonJS (`tsconfig.server.json`), but Vitest runs in ESM by default. The `vitest.config.ts` resolves this, but be careful when adding dependencies that only support ESM.
+
+3. **Mixed error patterns** — Some services return `{ error, status }`, others return discriminated unions `{ type: 'success' | 'error' }`. Prefer `{ error, status }` for consistency with existing routes.
+
+4. **Silent error catches** — A few service functions swallow errors in catch blocks. Always log at minimum; never use empty catch blocks.
+
+5. **HTML sanitization gap** — Rich text fields in invoices use DOMPurify, but quotation scope and order scope fields may not. If modifying those, add sanitization.
+
+6. **Puppeteer PDF generation** — Runs a headless browser. Input to the HTML template must be sanitized. Do not pass unsanitized user data into PDF templates.
+
+7. **NAS_PATH file access** — Project file uploads write to a network share path. In dev, this path may not be mounted. Features using `NAS_PATH` will fail gracefully (or not) if the path is unavailable.
+
+8. **Prisma client regeneration** — After any schema change, run `npx prisma generate`. The generated client is not committed to git.
+
+9. **No CSRF tokens** — CSRF protection relies on `SameSite=Strict` cookies + CORS. Do not weaken CORS configuration.
+
+10. **Czech locale hardcoded** — Error messages, month names, and some business logic strings are Czech. This is intentional.
+
+---
+
+## Release Process
+
+1. Bump version in `package.json`
+2. `npm run build`
+3. Create a tarball
+4. Tag the release in Gitea
+5. Deploy via SSH to production server (`boha_admin@192.168.50.100`)
+
+Do not push directly to production or restart services without confirmation.

index.html

@@ -19,7 +19,7 @@
     <link rel="icon" type="image/png" href="/favicon-96x96.png" sizes="96x96" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <link rel="shortcut icon" href="/favicon.ico" />
-    <title>BOHA | Admin</title>
+    <title>Admin</title>
   </head>
   <body>
     <div id="root"></div>

package-lock.json

@@ -1,12 +1,12 @@
 {
-  "name": "boha-app-ts",
-  "version": "1.0.0",
+  "name": "app-ts",
+  "version": "1.5.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "boha-app-ts",
-      "version": "1.0.0",
+      "name": "app-ts",
+      "version": "1.5.1",
       "license": "ISC",
       "dependencies": {
         "@dnd-kit/core": "^6.3.1",
@@ -28,6 +28,7 @@
         "framer-motion": "^12.38.0",
         "hi-base32": "^0.5.1",
         "jsonwebtoken": "^9.0.3",
+        "leaflet": "^1.9.4",
         "node-cron": "^4.2.1",
         "nodemailer": "^8.0.2",
         "otpauth": "^9.5.0",
@@ -45,6 +46,7 @@
         "@types/bcryptjs": "^2.4.6",
         "@types/dompurify": "^3.0.5",
         "@types/jsonwebtoken": "^9.0.10",
+        "@types/leaflet": "^1.9.21",
         "@types/mysql": "^2.15.27",
         "@types/node": "^25.5.0",
         "@types/node-cron": "^3.0.11",
@@ -1504,6 +1506,13 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/geojson": {
+      "version": "7946.0.16",
+      "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.16.tgz",
+      "integrity": "sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/jsonwebtoken": {
       "version": "9.0.10",
       "resolved": "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-9.0.10.tgz",
@@ -1515,6 +1524,16 @@
         "@types/node": "*"
       }
     },
+    "node_modules/@types/leaflet": {
+      "version": "1.9.21",
+      "resolved": "https://registry.npmjs.org/@types/leaflet/-/leaflet-1.9.21.tgz",
+      "integrity": "sha512-TbAd9DaPGSnzp6QvtYngntMZgcRk+igFELwR2N99XZn7RXUdKgsXMR+28bUO0rPsWp8MIu/f47luLIQuSLYv/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/geojson": "*"
+      }
+    },
     "node_modules/@types/methods": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/@types/methods/-/methods-1.1.4.tgz",
@@ -2070,9 +2089,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.4.tgz",
-      "integrity": "sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==",
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
+      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -3067,9 +3086,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/fastify": {
-      "version": "5.8.2",
-      "resolved": "https://registry.npmjs.org/fastify/-/fastify-5.8.2.tgz",
-      "integrity": "sha512-lZmt3navvZG915IE+f7/TIVamxIwmBd+OMB+O9WBzcpIwOo6F0LTh0sluoMFk5VkrKTvvrwIaoJPkir4Z+jtAg==",
+      "version": "5.8.4",
+      "resolved": "https://registry.npmjs.org/fastify/-/fastify-5.8.4.tgz",
+      "integrity": "sha512-sa42J1xylbBAYUWALSBoyXKPDUvM3OoNOibIefA+Oha57FryXKKCZarA1iDntOCWp3O35voZLuDg2mdODXtPzQ==",
       "funding": [
         {
           "type": "github",
@@ -3699,6 +3718,12 @@
         "safe-buffer": "^5.0.1"
       }
     },
+    "node_modules/leaflet": {
+      "version": "1.9.4",
+      "resolved": "https://registry.npmjs.org/leaflet/-/leaflet-1.9.4.tgz",
+      "integrity": "sha512-nxS1ynzJOmOlHp+iL3FyWqK89GtNL8U8rvlMOsQdTTssxZwCXh8N2NB3GDQOL+YR3XnWyZAxwQixURb+FA74PA==",
+      "license": "BSD-2-Clause"
+    },
     "node_modules/light-my-request": {
       "version": "6.6.0",
       "resolved": "https://registry.npmjs.org/light-my-request/-/light-my-request-6.6.0.tgz",
@@ -4257,9 +4282,9 @@
       "license": "MIT"
     },
     "node_modules/nodemailer": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.2.tgz",
-      "integrity": "sha512-zbj002pZAIkWQFxyAaqoxvn+zoIwRnS40hgjqTXudKOOJkiFFgBeNqjgD3/YCR12sZnrghWYBY+yP1ZucdDRpw==",
+      "version": "8.0.4",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.4.tgz",
+      "integrity": "sha512-k+jf6N8PfQJ0Fe8ZhJlgqU5qJU44Lpvp2yvidH3vp1lPnVQMgi4yEEMPXg5eJS1gFIJTVq1NHBk7Ia9ARdSBdQ==",
       "license": "MIT-0",
       "engines": {
         "node": ">=6.0.0"
@@ -4515,9 +4540,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {

package.json

@@ -1,6 +1,6 @@
 {
-  "name": "boha-app-ts",
-  "version": "1.0.0",
+  "name": "app-ts",
+  "version": "1.5.3",
   "description": "",
   "main": "dist/server.js",
   "scripts": {
@@ -43,6 +43,7 @@
     "framer-motion": "^12.38.0",
     "hi-base32": "^0.5.1",
     "jsonwebtoken": "^9.0.3",
+    "leaflet": "^1.9.4",
     "node-cron": "^4.2.1",
     "nodemailer": "^8.0.2",
     "otpauth": "^9.5.0",
@@ -60,6 +61,7 @@
     "@types/bcryptjs": "^2.4.6",
     "@types/dompurify": "^3.0.5",
     "@types/jsonwebtoken": "^9.0.10",
+    "@types/leaflet": "^1.9.21",
     "@types/mysql": "^2.15.27",
     "@types/node": "^25.5.0",
     "@types/node-cron": "^3.0.11",

prisma/migrations/20260327_add_dark_logo/migration.sql

@@ -0,0 +1 @@
+ALTER TABLE `company_settings` ADD COLUMN `logo_data_dark` MEDIUMBLOB NULL AFTER `logo_data`;

prisma/migrations/20260327_add_number_patterns/migration.sql

@@ -0,0 +1,4 @@
+ALTER TABLE `company_settings`
+  ADD COLUMN `offer_number_pattern` VARCHAR(100) NULL,
+  ADD COLUMN `order_number_pattern` VARCHAR(100) NULL,
+  ADD COLUMN `invoice_number_pattern` VARCHAR(100) NULL;

prisma/migrations/20260327_add_smtp_settings/migration.sql

@@ -0,0 +1,3 @@
+ALTER TABLE `company_settings`
+  ADD COLUMN `smtp_from` VARCHAR(255) NULL,
+  ADD COLUMN `smtp_from_name` VARCHAR(255) NULL;

prisma/migrations/20260327_add_system_settings/migration.sql

@@ -0,0 +1,13 @@
+-- System settings columns on company_settings
+ALTER TABLE `company_settings`
+  ADD COLUMN `break_threshold_hours` DECIMAL(4,2) DEFAULT 6,
+  ADD COLUMN `break_duration_short` INT DEFAULT 15,
+  ADD COLUMN `break_duration_long` INT DEFAULT 30,
+  ADD COLUMN `clock_rounding_minutes` INT DEFAULT 15,
+  ADD COLUMN `invoice_alert_email` VARCHAR(255) NULL,
+  ADD COLUMN `leave_notify_email` VARCHAR(255) NULL,
+  ADD COLUMN `max_login_attempts` INT DEFAULT 5,
+  ADD COLUMN `lockout_minutes` INT DEFAULT 15,
+  ADD COLUMN `max_requests_per_minute` INT DEFAULT 300,
+  ADD COLUMN `available_vat_rates` LONGTEXT NULL,
+  ADD COLUMN `available_currencies` LONGTEXT NULL;

prisma/migrations/20260327_consolidate_settings_permissions/migration.sql

@@ -0,0 +1,18 @@
+-- Create new unified permission
+INSERT INTO permissions (name, display_name, description, module)
+VALUES ('settings.manage', 'Správa nastavení', 'Správa všech nastavení systému', 'settings')
+ON DUPLICATE KEY UPDATE display_name = VALUES(display_name);
+
+-- Grant to all roles that had any of the old 3
+INSERT IGNORE INTO role_permissions (role_id, permission_id)
+SELECT DISTINCT rp.role_id, (SELECT id FROM permissions WHERE name = 'settings.manage')
+FROM role_permissions rp
+JOIN permissions p ON p.id = rp.permission_id
+WHERE p.name IN ('offers.settings', 'settings.roles', 'settings.security');
+
+-- Clean up old role_permissions
+DELETE FROM role_permissions
+WHERE permission_id IN (SELECT id FROM permissions WHERE name IN ('offers.settings', 'settings.roles', 'settings.security'));
+
+-- Remove old permissions
+DELETE FROM permissions WHERE name IN ('offers.settings', 'settings.roles', 'settings.security');

prisma/migrations/20260422_add_number_sequences_unique/migration.sql

@@ -0,0 +1,2 @@
+-- Add unique constraint on number_sequences(type, year) for atomic numbering
+ALTER TABLE number_sequences ADD UNIQUE INDEX idx_number_sequences_type_year (`type`, `year`);

prisma/schema.prisma

@@ -100,6 +100,7 @@ model company_settings {
   vat_id            String?   @db.VarChar(50)
   custom_fields     String?   @db.LongText
   logo_data         Bytes?
+  logo_data_dark    Bytes?
   quotation_prefix  String?   @db.VarChar(20)
   default_currency  String?   @default("CZK") @db.VarChar(10)
   default_vat_rate  Decimal?  @default(21.00) @db.Decimal(5, 2)
@@ -109,7 +110,23 @@ model company_settings {
   sync_version      Int?      @default(0)
   order_type_code   String?   @db.VarChar(10)
   invoice_type_code String?   @db.VarChar(10)
-  require_2fa       Boolean   @default(false)
+  require_2fa              Boolean   @default(false)
+  break_threshold_hours    Decimal?  @default(6) @db.Decimal(4, 2)
+  break_duration_short     Int?      @default(15)
+  break_duration_long      Int?      @default(30)
+  clock_rounding_minutes   Int?      @default(15)
+  invoice_alert_email      String?   @db.VarChar(255)
+  leave_notify_email       String?   @db.VarChar(255)
+  max_login_attempts       Int?      @default(5)
+  lockout_minutes          Int?      @default(15)
+  max_requests_per_minute  Int?      @default(300)
+  available_vat_rates      String?   @db.LongText
+  available_currencies     String?   @db.LongText
+  smtp_from                String?   @db.VarChar(255)
+  smtp_from_name           String?   @db.VarChar(255)
+  offer_number_pattern     String?   @db.VarChar(100)
+  order_number_pattern     String?   @db.VarChar(100)
+  invoice_number_pattern   String?   @db.VarChar(100)
 }
 
 model customers {
@@ -236,6 +253,8 @@ model number_sequences {
   type        String? @db.VarChar(50)
   year        Int?
   last_number Int?    @default(0)
+
+  @@unique([type, year], map: "idx_number_sequences_type_year")
 }
 
 model order_items {

src/__tests__/numbering.test.ts

@@ -1,21 +1,50 @@
-import { describe, it, expect } from "vitest";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
 import {
   generateSharedNumber,
   generateOfferNumber,
 } from "../services/numbering.service";
+import prisma from "../config/database";
 
 describe("generateSharedNumber", () => {
-  it("returns correct format (YYtypeCode + 4 digits)", async () => {
+  beforeEach(async () => {
+    await prisma.number_sequences.deleteMany({ where: { type: "shared" } });
+  });
+
+  afterEach(async () => {
+    await prisma.number_sequences.deleteMany({ where: { type: "shared" } });
+  });
+
+  it("returns a non-empty string", async () => {
     const num = await generateSharedNumber();
-    const yy = String(new Date().getFullYear()).slice(-2);
-    expect(num).toMatch(new RegExp(`^${yy}\\d{2,}\\d{4}$`));
+    expect(typeof num).toBe("string");
+    expect(num.length).toBeGreaterThan(0);
+  });
+
+  it("increments on consecutive calls", async () => {
+    const num1 = await generateSharedNumber();
+    const num2 = await generateSharedNumber();
+    expect(num1).not.toBe(num2);
   });
 });
 
 describe("generateOfferNumber", () => {
-  it("returns correct format (YEAR/PREFIX/NNN)", async () => {
+  beforeEach(async () => {
+    await prisma.number_sequences.deleteMany({ where: { type: "offer" } });
+  });
+
+  afterEach(async () => {
+    await prisma.number_sequences.deleteMany({ where: { type: "offer" } });
+  });
+
+  it("returns a non-empty string", async () => {
     const num = await generateOfferNumber();
-    const year = new Date().getFullYear();
-    expect(num).toMatch(new RegExp(`^${year}/[A-Z]+/\\d{3,}$`));
+    expect(typeof num).toBe("string");
+    expect(num.length).toBeGreaterThan(0);
+  });
+
+  it("increments on consecutive calls", async () => {
+    const num1 = await generateOfferNumber();
+    const num2 = await generateOfferNumber();
+    expect(num1).not.toBe(num2);
   });
 });

src/admin/AdminApp.tsx

@@ -7,7 +7,18 @@ import AdminLayout from "./components/AdminLayout";
 import AlertContainer from "./components/AlertContainer";
 import Login from "./pages/Login";
 import Dashboard from "./pages/Dashboard";
-import "./admin.css";
+import "./variables.css";
+import "./base.css";
+import "./forms.css";
+import "./buttons.css";
+import "./layout.css";
+import "./components.css";
+import "./tables.css";
+import "./skeleton.css";
+import "./datepicker.css";
+import "./filemanager.css";
+import "./pagination.css";
+import "./responsive.css";
 import "./login.css";
 import "./dashboard.css";
 import "./attendance.css";
@@ -32,7 +43,6 @@ const Offers = lazy(() => import("./pages/Offers"));
 const OfferDetail = lazy(() => import("./pages/OfferDetail"));
 const OffersCustomers = lazy(() => import("./pages/OffersCustomers"));
 const OffersTemplates = lazy(() => import("./pages/OffersTemplates"));
-const CompanySettings = lazy(() => import("./pages/CompanySettings"));
 const Orders = lazy(() => import("./pages/Orders"));
 const OrderDetail = lazy(() => import("./pages/OrderDetail"));
 const Projects = lazy(() => import("./pages/Projects"));
@@ -91,7 +101,6 @@ export default function AdminApp() {
                 <Route path="offers/:id" element={<OfferDetail />} />
                 <Route path="offers/customers" element={<OffersCustomers />} />
                 <Route path="offers/templates" element={<OffersTemplates />} />
-                <Route path="company/settings" element={<CompanySettings />} />
                 <Route path="orders" element={<Orders />} />
                 <Route path="orders/:id" element={<OrderDetail />} />
                 <Route path="projects" element={<Projects />} />

src/admin/base.css

@@ -0,0 +1,420 @@
+/* ============================================================================
+   Reset & Base
+   ============================================================================ */
+
+* {
+  margin: 0;
+  padding: 0;
+  box-sizing: border-box;
+}
+
+html {
+  scroll-behavior: smooth;
+  overflow-x: hidden;
+}
+
+html,
+body,
+#root {
+  min-height: 100%;
+  min-height: 100dvh;
+  max-width: 100vw;
+}
+
+body {
+  font-family: var(--font-body);
+  font-size: 16px;
+  line-height: 1.6;
+  color: var(--text-primary);
+  background: var(--bg-primary);
+  overflow-x: hidden;
+  overscroll-behavior-x: none;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+  transition:
+    background-color 0.3s ease,
+    color 0.3s ease;
+}
+
+.admin-sidebar,
+.admin-header,
+.admin-card,
+.admin-modal {
+  transition:
+    background-color 0.3s ease,
+    color 0.3s ease,
+    border-color 0.3s ease;
+}
+
+#root {
+  overflow-x: hidden;
+  touch-action: pan-y pinch-zoom;
+}
+
+h1,
+h2,
+h3,
+h4,
+h5,
+h6 {
+  font-family: var(--font-heading);
+  font-weight: 700;
+  line-height: 1.2;
+  color: var(--text-primary);
+}
+
+h1 {
+  font-size: clamp(2.5rem, 5vw, 4rem);
+}
+h2 {
+  font-size: clamp(2rem, 4vw, 3rem);
+}
+h3 {
+  font-size: clamp(1.25rem, 2vw, 1.5rem);
+}
+
+p {
+  color: var(--text-secondary);
+  line-height: 1.6;
+}
+
+a {
+  color: inherit;
+  text-decoration: none;
+  transition: var(--transition);
+}
+
+img {
+  max-width: 100%;
+  height: auto;
+}
+
+::-webkit-scrollbar {
+  width: 8px;
+}
+
+::-webkit-scrollbar-track {
+  background: var(--bg-secondary);
+}
+
+::-webkit-scrollbar-thumb {
+  background: var(--border-color);
+  border-radius: 4px;
+}
+
+::-webkit-scrollbar-thumb:hover {
+  background: var(--text-muted);
+}
+
+::selection {
+  background: var(--accent-color);
+  color: #fff;
+}
+
+/* ============================================================================
+   Base / Utilities
+   ============================================================================ */
+
+.text-warning {
+  color: var(--warning) !important;
+}
+
+.text-danger {
+  color: var(--danger) !important;
+}
+
+.text-success {
+  color: var(--success) !important;
+}
+
+.text-muted {
+  color: var(--text-muted) !important;
+}
+
+.text-secondary {
+  color: var(--text-secondary) !important;
+}
+
+.text-tertiary {
+  color: var(--text-tertiary) !important;
+}
+
+.text-accent {
+  color: var(--accent-color) !important;
+}
+
+.fw-600 {
+  font-weight: 600 !important;
+}
+
+.link-accent {
+  color: var(--accent-color);
+  font-weight: 500;
+  text-decoration: none;
+}
+
+.link-accent:hover {
+  text-decoration: underline;
+}
+
+/* Layout utilities */
+.flex-1 {
+  flex: 1;
+}
+.flex-row {
+  display: flex;
+  align-items: center;
+}
+.flex-row-gap {
+  display: flex;
+  align-items: center;
+  gap: var(--space-3);
+}
+.flex-between {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+}
+
+/* Spacing utilities */
+.mb-2 {
+  margin-bottom: var(--space-2);
+}
+.mb-4 {
+  margin-bottom: var(--space-4);
+}
+.mb-6 {
+  margin-bottom: var(--space-6);
+}
+.mt-2 {
+  margin-top: var(--space-2);
+}
+.mt-6 {
+  margin-top: var(--space-6);
+}
+.gap-2 {
+  gap: var(--space-2);
+}
+.gap-4 {
+  gap: var(--space-4);
+}
+.gap-5 {
+  gap: var(--space-5);
+}
+
+/* Typography utilities */
+.fw-500 {
+  font-weight: 500;
+}
+.text-right {
+  text-align: right;
+}
+.text-center {
+  text-align: center;
+}
+
+/* Spinner variant */
+.admin-spinner-sm {
+  width: 16px;
+  height: 16px;
+  border-width: 2px;
+}
+
+/* Monospace for data values (times, dates, numbers, IDs) */
+.admin-mono {
+  font-family: var(--font-mono);
+  font-size: 0.875em;
+  letter-spacing: -0.01em;
+}
+
+/* Drag handle */
+.admin-drag-handle {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 24px;
+  height: 24px;
+  border: none;
+  background: none;
+  color: var(--text-muted);
+  cursor: grab;
+  border-radius: 4px;
+  padding: 0;
+  transition:
+    color 0.15s,
+    background 0.15s;
+  touch-action: none;
+}
+
+.admin-drag-handle:hover {
+  color: var(--text-primary);
+  background: var(--bg-secondary);
+}
+
+.admin-drag-handle:active {
+  cursor: grabbing;
+}
+
+/* Error stack (DEV only) */
+.admin-error-stack {
+  max-width: 600px;
+  max-height: 200px;
+  overflow: auto;
+  padding: 0.75rem 1rem;
+  margin: 0;
+  border-radius: var(--border-radius-sm);
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border-color);
+  color: var(--danger-color);
+  font-family: var(--font-mono);
+  font-size: 11px;
+  line-height: 1.5;
+  text-align: left;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+
+/* Keyboard shortcut badge */
+.admin-kbd {
+  display: inline-block;
+  padding: 2px 7px;
+  font-family: var(--font-mono);
+  font-size: 12px;
+  line-height: 1.4;
+  border-radius: 4px;
+  background: var(--bg-secondary);
+  border: 1px solid var(--border-color);
+  white-space: nowrap;
+}
+
+/* Loading & Animations */
+.admin-spinner {
+  width: 32px;
+  height: 32px;
+  border: 2px solid var(--accent-color);
+  border-top-color: transparent;
+  border-radius: 50%;
+  animation: spin 0.8s linear infinite;
+}
+
+.admin-loading {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  min-height: 256px;
+}
+
+@keyframes spin {
+  to {
+    transform: rotate(360deg);
+  }
+}
+
+@keyframes float {
+  0%,
+  100% {
+    transform: translate(0, 0);
+  }
+  50% {
+    transform: translate(30px, -30px);
+  }
+}
+
+@keyframes pulse {
+  0%,
+  100% {
+    opacity: 1;
+  }
+  50% {
+    opacity: 0.5;
+  }
+}
+
+@keyframes shimmer {
+  0% {
+    background-position: -200% 0;
+  }
+  100% {
+    background-position: 200% 0;
+  }
+}
+
+/* ── Additional Utilities ─────────────────────────────────────────── */
+
+/* Font sizes */
+.text-xs {
+  font-size: 0.75rem;
+}
+.text-sm {
+  font-size: 0.8125rem;
+}
+.text-md {
+  font-size: 0.875rem;
+}
+.text-base {
+  font-size: 1rem;
+}
+
+/* Width utilities */
+.w-full {
+  width: 100%;
+}
+.max-w-xs {
+  max-width: 120px;
+}
+.max-w-sm {
+  max-width: 200px;
+}
+
+/* Whitespace */
+.whitespace-nowrap {
+  white-space: nowrap;
+}
+
+/* Additional gaps */
+.gap-1 {
+  gap: 0.25rem;
+}
+.gap-3 {
+  gap: 0.75rem;
+}
+.gap-6 {
+  gap: 1.5rem;
+}
+
+/* Additional margins */
+.mb-1 {
+  margin-bottom: 0.25rem;
+}
+.mb-3 {
+  margin-bottom: 0.75rem;
+}
+.mt-1 {
+  margin-top: 0.25rem;
+}
+.mt-3 {
+  margin-top: 0.75rem;
+}
+
+/* Display */
+.inline-flex {
+  display: inline-flex;
+  align-items: center;
+}
+
+/* Prefers reduced motion */
+@media (prefers-reduced-motion: reduce) {
+  *,
+  *::before,
+  *::after {
+    animation-duration: 0.01ms !important;
+    animation-iteration-count: 1 !important;
+    transition-duration: 0.01ms !important;
+    scroll-behavior: auto !important;
+  }
+
+  .admin-spinner {
+    animation-duration: 0.8s !important;
+    animation-iteration-count: infinite !important;
+  }
+}

src/admin/buttons.css

@@ -0,0 +1,130 @@
+/* ============================================================================
+   Buttons
+   ============================================================================ */
+
+.admin-btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.5rem;
+  padding: 8px 14px;
+  border: none;
+  border-radius: var(--border-radius-sm);
+  font-size: 13px;
+  font-weight: 550;
+  font-family: inherit;
+  cursor: pointer;
+  transition: var(--transition);
+  white-space: nowrap;
+}
+
+.admin-btn:disabled {
+  opacity: 0.7;
+  cursor: not-allowed;
+}
+
+/* Prevent buttons from growing when text changes to spinner + loading text */
+.admin-modal-footer .admin-btn {
+  min-width: 100px;
+}
+.admin-modal-footer .admin-btn .admin-spinner {
+  margin: -2px 0;
+}
+
+.admin-btn-sm {
+  padding: 6px 11px;
+  font-size: 12px;
+}
+
+.admin-btn-primary {
+  background: var(--accent-color);
+  color: #fff;
+}
+
+.admin-btn-primary:hover:not(:disabled) {
+  background: var(--accent-hover);
+  transform: translateY(-1px);
+  box-shadow: 0 4px 12px rgba(214, 48, 49, 0.3);
+}
+
+.admin-btn .admin-spinner {
+  width: 16px;
+  height: 16px;
+  border-width: 2px;
+}
+
+.admin-btn-primary .admin-spinner {
+  border-color: rgba(255, 255, 255, 0.3);
+  border-top-color: #fff;
+}
+
+.admin-btn-secondary .admin-spinner {
+  border-color: rgba(var(--text-secondary-rgb, 107, 114, 128), 0.3);
+  border-top-color: var(--text-secondary);
+}
+
+.admin-btn-secondary {
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border-color);
+  color: var(--text-secondary);
+}
+
+.admin-btn-secondary:hover:not(:disabled) {
+  background: var(--bg-secondary);
+  border-color: var(--border-color-hover);
+  color: var(--text-primary);
+}
+
+.admin-btn-icon {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0;
+  width: 32px;
+  height: 32px;
+  background: transparent;
+  border: none;
+  color: var(--text-secondary);
+  border-radius: var(--border-radius-sm);
+  cursor: pointer;
+  transition: var(--transition);
+}
+
+.admin-btn-icon:hover {
+  background: var(--bg-tertiary);
+  color: var(--text-primary);
+}
+
+.admin-btn-icon.accent {
+  color: var(--info);
+}
+
+.admin-btn-icon.accent:hover {
+  background: color-mix(in srgb, var(--info) 15%, transparent);
+  color: var(--info);
+}
+
+.admin-btn-icon.danger {
+  color: var(--danger);
+}
+
+.admin-btn-icon.danger:hover {
+  background: var(--danger-light);
+}
+
+/* Touch targets - min 44px on mobile */
+@media (max-width: 768px) {
+  .admin-btn {
+    min-height: 44px;
+    padding: 10px 16px;
+  }
+
+  .admin-btn-sm {
+    min-height: 36px;
+  }
+
+  .admin-btn-icon {
+    min-width: 44px;
+    min-height: 44px;
+  }
+}

src/admin/components.css

@@ -0,0 +1,925 @@
+/* ============================================================================
+   Cards
+   ============================================================================ */
+
+.admin-card {
+  background: var(--card-bg);
+  border: 1px solid var(--glass-border);
+  box-shadow: var(--glass-shadow);
+  border-radius: var(--border-radius);
+  overflow: hidden;
+  margin-bottom: 1rem;
+}
+
+.admin-card:last-child {
+  margin-bottom: 0;
+}
+
+.admin-card-header {
+  padding: 14px 18px;
+  border-bottom: 1px solid var(--border-color);
+}
+
+.admin-card-title {
+  font-size: 14px;
+  font-weight: 650;
+  color: var(--text-primary);
+  margin: 0 0 12px 0;
+}
+
+.admin-card-body {
+  padding: 18px;
+}
+
+@media (max-width: 480px) {
+  .admin-card-body {
+    padding: 12px;
+  }
+
+  .admin-card-header {
+    padding: 12px;
+  }
+}
+
+/* ============================================================================
+   Badges
+   ============================================================================ */
+
+.admin-badge {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.375rem;
+  padding: 3px 9px;
+  border-radius: 9999px;
+  font-size: 11.5px;
+  font-weight: 600;
+  border: none;
+  font-family: inherit;
+  white-space: nowrap;
+  max-width: 100%;
+}
+
+.admin-badge-wrap {
+  white-space: normal;
+  word-break: break-word;
+  border-radius: var(--border-radius-sm);
+  text-align: left;
+}
+
+.admin-badge-admin {
+  background: var(--accent-soft);
+  color: var(--accent-color);
+}
+
+.admin-badge-viewer {
+  background: var(--bg-tertiary);
+  color: var(--text-secondary);
+}
+
+.admin-badge-active {
+  background: var(--success-soft);
+  color: var(--success);
+  cursor: pointer;
+  transition: var(--transition);
+}
+
+.admin-badge-active:hover {
+  background: color-mix(in srgb, var(--success) 20%, transparent);
+}
+
+.admin-badge-inactive {
+  background: var(--danger-soft);
+  color: var(--danger);
+  cursor: pointer;
+  transition: var(--transition);
+}
+
+.admin-badge-inactive:hover {
+  background: color-mix(in srgb, var(--danger) 20%, transparent);
+}
+
+.admin-badge-success {
+  background: var(--success-soft);
+  color: var(--success);
+}
+
+.admin-badge-warning {
+  background: var(--warning-soft);
+  color: var(--warning);
+}
+
+.admin-badge-secondary {
+  background: var(--bg-tertiary);
+  color: var(--text-muted);
+}
+
+.admin-badge-info {
+  background: var(--info-soft);
+  color: var(--info);
+}
+
+.admin-badge-danger {
+  background: var(--danger-soft);
+  color: var(--danger);
+}
+
+/* Status Badges - Leave Requests */
+.badge-pending {
+  background: color-mix(in srgb, var(--warning) 15%, transparent);
+  color: var(--warning);
+}
+.badge-approved {
+  background: color-mix(in srgb, var(--success) 15%, transparent);
+  color: var(--success);
+}
+.badge-rejected {
+  background: color-mix(in srgb, var(--danger) 15%, transparent);
+  color: var(--danger);
+}
+.badge-cancelled {
+  background: var(--muted-light);
+  color: var(--muted);
+}
+
+/* Status Badges - Orders */
+.admin-badge-order-prijata {
+  background: color-mix(in srgb, var(--info) 15%, transparent);
+  color: var(--info);
+}
+.admin-badge-order-realizace {
+  background: color-mix(in srgb, var(--warning) 15%, transparent);
+  color: var(--warning);
+}
+.admin-badge-order-dokoncena {
+  background: color-mix(in srgb, var(--success) 15%, transparent);
+  color: var(--success);
+}
+.admin-badge-order-stornovana {
+  background: color-mix(in srgb, var(--danger) 15%, transparent);
+  color: var(--danger);
+}
+
+/* Status Badges - Projects */
+.admin-badge-project-aktivni {
+  background: color-mix(in srgb, var(--success) 15%, transparent);
+  color: var(--success);
+}
+.admin-badge-project-dokonceny {
+  background: color-mix(in srgb, var(--info) 15%, transparent);
+  color: var(--info);
+}
+.admin-badge-project-zruseny {
+  background: color-mix(in srgb, var(--danger) 15%, transparent);
+  color: var(--danger);
+}
+
+/* Badge on mobile - larger for touch */
+@media (max-width: 768px) {
+  .admin-badge {
+    padding: 4px 10px;
+    font-size: 12px;
+  }
+
+  button.admin-badge {
+    min-height: 32px;
+  }
+}
+
+/* ============================================================================
+   Modals
+   ============================================================================ */
+
+.admin-modal-overlay {
+  position: fixed;
+  inset: 0;
+  z-index: 50;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 1rem;
+  overflow: hidden;
+  overscroll-behavior: none;
+  touch-action: none;
+}
+
+.admin-modal-backdrop {
+  position: absolute;
+  inset: 0;
+  background: rgba(0, 0, 0, 0.6);
+  touch-action: none;
+}
+
+.admin-modal {
+  position: relative;
+  width: 100%;
+  max-width: 480px;
+  background: var(--bg-secondary);
+  border: 1px solid var(--border-color);
+  border-radius: var(--border-radius);
+  max-height: calc(100vh - 2rem);
+  max-height: calc(100dvh - 2rem);
+  overflow: hidden;
+  display: flex;
+  flex-direction: column;
+  touch-action: auto;
+}
+
+.admin-modal-lg {
+  max-width: 900px;
+}
+
+.admin-modal-header {
+  padding: 18px;
+  border-bottom: 1px solid var(--border-color);
+  flex-shrink: 0;
+}
+
+.admin-modal-title {
+  font-size: 16px;
+  font-weight: 700;
+  color: var(--text-primary);
+}
+
+.admin-modal-body {
+  padding: 18px;
+  overflow-y: auto;
+  flex: 1;
+  -webkit-overflow-scrolling: touch;
+  overscroll-behavior: contain;
+  background: var(--bg-primary);
+}
+
+.admin-modal-footer {
+  padding: 14px 18px;
+  border-top: 1px solid var(--border-color);
+  display: flex;
+  gap: 0.75rem;
+  justify-content: flex-end;
+  flex-shrink: 0;
+}
+
+@media (max-width: 768px) {
+  .admin-modal-overlay {
+    padding: 0;
+  }
+
+  .admin-modal,
+  .admin-modal.admin-modal-lg {
+    max-width: 100%;
+    width: 100%;
+    height: 100%;
+    height: 100dvh;
+    max-height: 100%;
+    max-height: 100dvh;
+    border-radius: 0;
+    border: none;
+  }
+
+  .admin-modal-header {
+    padding: 1rem;
+    padding-top: calc(1rem + env(safe-area-inset-top, 0px));
+  }
+
+  .admin-modal-body {
+    padding: 1rem;
+    flex: 1;
+    overflow-y: auto;
+    overflow-x: hidden;
+    -webkit-overflow-scrolling: touch;
+  }
+
+  .admin-modal-footer {
+    padding: 1rem;
+    padding-bottom: calc(1rem + env(safe-area-inset-bottom, 0px));
+  }
+
+  .admin-modal .admin-form-input,
+  .admin-modal .admin-form-select,
+  .admin-modal .admin-form-textarea {
+    max-width: 100%;
+  }
+}
+
+/* Confirm Modal */
+.admin-confirm-modal {
+  max-width: 400px;
+}
+
+.admin-confirm-content {
+  text-align: center;
+  padding: 2rem 1.5rem;
+}
+
+.admin-confirm-icon {
+  width: 56px;
+  height: 56px;
+  border-radius: 50%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  margin: 0 auto 1.25rem;
+}
+
+.admin-confirm-icon-danger {
+  background: var(--danger-light);
+  color: var(--danger);
+}
+
+.admin-confirm-icon-warning {
+  background: var(--warning-light);
+  color: var(--warning);
+}
+
+.admin-confirm-icon-info {
+  background: var(--info-light);
+  color: var(--info);
+}
+
+.admin-confirm-icon-default {
+  background: var(--bg-tertiary);
+  color: var(--text-secondary);
+}
+
+.admin-confirm-title {
+  font-size: 1.25rem;
+  font-weight: 700;
+  color: var(--text-primary);
+  margin-bottom: 0.5rem;
+}
+
+.admin-confirm-message {
+  color: var(--text-secondary);
+  font-size: 0.95rem;
+  line-height: 1.5;
+}
+
+@media (max-width: 768px) {
+  .admin-confirm-modal {
+    max-width: 100%;
+    height: auto;
+    max-height: calc(100% - 2rem);
+    max-height: calc(100dvh - 2rem);
+    margin: 1rem;
+    border-radius: var(--border-radius);
+    border: 1px solid var(--border-color);
+  }
+
+  .admin-confirm-modal .admin-modal-footer {
+    padding-bottom: calc(1rem + env(safe-area-inset-bottom, 0px));
+  }
+}
+
+/* Confirm modal on small mobile */
+@media (max-width: 480px) {
+  .admin-confirm-content {
+    padding: 1.5rem 1rem;
+  }
+
+  .admin-confirm-title {
+    font-size: 1.1rem;
+  }
+
+  .admin-confirm-message {
+    font-size: 0.875rem;
+  }
+}
+
+/* ============================================================================
+   Toast Alerts
+   ============================================================================ */
+
+.admin-alert-container {
+  position: fixed;
+  bottom: calc(1rem + env(safe-area-inset-bottom, 0px));
+  right: 1rem;
+  z-index: 100;
+  display: flex;
+  flex-direction: column-reverse;
+  gap: 0.5rem;
+  max-width: 400px;
+  width: calc(100% - 2rem);
+  pointer-events: none;
+  transform: translateZ(0);
+}
+
+@media (min-width: 640px) {
+  .admin-alert-container {
+    bottom: calc(1.5rem + env(safe-area-inset-bottom, 0px));
+    right: 1.5rem;
+  }
+}
+
+.admin-toast {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  padding: 0.875rem 1rem;
+  border-radius: var(--border-radius-sm);
+  background: var(--bg-secondary);
+  border: 1px solid var(--border-color);
+  box-shadow: 0 4px 12px rgba(0, 0, 0, 0.3);
+  pointer-events: auto;
+}
+
+.admin-toast-icon {
+  flex-shrink: 0;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+.admin-toast-message {
+  flex: 1;
+  font-size: 0.875rem;
+  color: var(--text-primary);
+}
+
+.admin-toast-close {
+  flex-shrink: 0;
+  padding: 0.25rem;
+  background: transparent;
+  border: none;
+  color: var(--text-muted);
+  cursor: pointer;
+  border-radius: var(--border-radius-sm);
+  transition: var(--transition);
+}
+
+.admin-toast-close:hover {
+  background: var(--bg-tertiary);
+  color: var(--text-primary);
+}
+
+.admin-toast-success .admin-toast-icon {
+  color: var(--success);
+}
+.admin-toast-error .admin-toast-icon {
+  color: var(--danger);
+}
+.admin-toast-warning .admin-toast-icon {
+  color: var(--warning);
+}
+.admin-toast-info .admin-toast-icon {
+  color: var(--info);
+}
+
+/* ============================================================================
+   Tabs (Global)
+   ============================================================================ */
+
+.admin-tabs {
+  display: inline-flex;
+  gap: 4px;
+  padding: 4px;
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border-color);
+  border-radius: 0.625rem;
+}
+
+.admin-tab {
+  position: relative;
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 0.5rem 1.25rem;
+  background: transparent;
+  border: none;
+  border-radius: 0.5rem;
+  color: var(--text-muted);
+  font-size: 0.8125rem;
+  font-weight: 500;
+  font-family: inherit;
+  cursor: pointer;
+  transition:
+    color 0.2s ease,
+    background 0.2s ease,
+    box-shadow 0.2s ease;
+  letter-spacing: 0.01em;
+  white-space: nowrap;
+}
+
+.admin-tab:hover {
+  color: var(--text-primary);
+}
+
+.admin-tab.active {
+  color: var(--text-primary);
+  font-weight: 600;
+  background: var(--bg-secondary);
+  box-shadow:
+    0 1px 3px rgba(0, 0, 0, 0.12),
+    0 0 0 1px var(--border-color);
+}
+
+/* ============================================================================
+   Empty State
+   ============================================================================ */
+
+.admin-empty-state {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  text-align: center;
+  padding: 3rem 1.5rem;
+  color: var(--text-secondary);
+}
+
+.admin-empty-icon {
+  width: 64px;
+  height: 64px;
+  border-radius: 50%;
+  background: var(--bg-tertiary);
+  color: var(--text-muted);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  margin-bottom: 1.25rem;
+}
+
+.admin-empty-state p {
+  margin-bottom: 1rem;
+  font-size: 0.95rem;
+  max-width: 320px;
+}
+
+.admin-role-locked-notice {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 0.75rem 1rem;
+  background: var(--warning-light);
+  border: 1px solid color-mix(in srgb, var(--warning) 25%, transparent);
+  border-radius: 0.5rem;
+  color: var(--warning);
+  font-size: 0.875rem;
+  margin-bottom: 0.5rem;
+}
+
+/* ============================================================================
+   Forbidden (403)
+   ============================================================================ */
+
+.forbidden-page {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  min-height: 60vh;
+  text-align: center;
+  padding: 2rem;
+}
+
+.forbidden-icon {
+  color: var(--accent-color);
+  margin-bottom: 1.5rem;
+  opacity: 0.8;
+}
+
+.forbidden-title {
+  font-family: var(--font-heading);
+  font-size: 2rem;
+  font-weight: 700;
+  color: var(--text-primary);
+  margin: 0 0 0.75rem;
+}
+
+.forbidden-text {
+  color: var(--text-secondary);
+  font-size: 1rem;
+  max-width: 400px;
+  line-height: 1.6;
+  margin: 0 0 2rem;
+}
+
+.forbidden-link {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 0.75rem 1.5rem;
+  background: var(--accent-color);
+  color: #fff;
+  border-radius: var(--border-radius-sm);
+  text-decoration: none;
+  font-weight: 600;
+  transition: var(--transition);
+}
+
+.forbidden-link:hover {
+  background: var(--accent-hover);
+  transform: translateY(-1px);
+}
+
+/* ============================================================================
+   Stat Cards
+   ============================================================================ */
+
+.admin-stat-card {
+  position: relative;
+  background: var(--glass-bg);
+  backdrop-filter: blur(12px);
+  -webkit-backdrop-filter: blur(12px);
+  border: 1px solid var(--glass-border);
+  box-shadow: var(--glass-shadow);
+  border-radius: var(--border-radius);
+  padding: 1.25rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  overflow: hidden;
+}
+
+.admin-stat-card::before {
+  content: "";
+  position: absolute;
+  top: 0;
+  left: 0;
+  right: 0;
+  height: 3px;
+  background: var(--accent-color);
+  border-radius: var(--border-radius) var(--border-radius) 0 0;
+}
+
+.admin-stat-card.success::before {
+  background: var(--success);
+}
+.admin-stat-card.warning::before {
+  background: var(--warning);
+}
+.admin-stat-card.danger::before {
+  background: var(--danger);
+}
+.admin-stat-card.info::before {
+  background: var(--info);
+}
+
+.admin-stat-icon {
+  width: 40px;
+  height: 40px;
+  border-radius: var(--border-radius-sm);
+  background: var(--accent-soft);
+  color: var(--accent-color);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex-shrink: 0;
+}
+
+.admin-stat-content {
+  display: flex;
+  flex-direction: column;
+  gap: 0.125rem;
+}
+
+.admin-stat-value {
+  font-size: 28px;
+  font-weight: 700;
+  color: var(--text-primary);
+  font-family: var(--font-mono);
+  letter-spacing: -0.02em;
+  line-height: 1.2;
+}
+
+.admin-stat-label {
+  font-size: 0.6875rem;
+  font-weight: 600;
+  color: var(--text-muted);
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.admin-stat-footer {
+  font-size: 0.75rem;
+  color: var(--text-secondary);
+}
+
+.admin-stat-icon.danger {
+  background: var(--danger-soft);
+  color: var(--danger);
+}
+.admin-stat-icon.info {
+  background: var(--info-soft);
+  color: var(--info);
+}
+.admin-stat-icon.success {
+  background: var(--success-soft);
+  color: var(--success);
+}
+.admin-stat-icon.warning {
+  background: var(--warning-soft);
+  color: var(--warning);
+}
+
+/* ============================================================================
+   KPI Grid
+   ============================================================================ */
+
+.admin-kpi-grid {
+  display: grid;
+  gap: 0.875rem;
+}
+
+.admin-kpi-4 {
+  grid-template-columns: repeat(4, 1fr);
+}
+.admin-kpi-3 {
+  grid-template-columns: repeat(3, 1fr);
+}
+.admin-kpi-2 {
+  grid-template-columns: repeat(2, 1fr);
+}
+.admin-kpi-1 {
+  grid-template-columns: 1fr;
+  max-width: 320px;
+}
+
+@media (max-width: 1024px) {
+  .admin-kpi-4 {
+    grid-template-columns: repeat(2, 1fr);
+  }
+}
+
+@media (max-width: 768px) {
+  .admin-kpi-grid {
+    grid-template-columns: repeat(2, 1fr);
+  }
+}
+
+@media (max-width: 480px) {
+  .admin-kpi-grid {
+    grid-template-columns: 1fr;
+  }
+}
+
+/* ============================================================================
+   Editor Section Cards
+   ============================================================================ */
+
+.admin-editor-section {
+  background: var(--glass-bg);
+  backdrop-filter: blur(12px);
+  -webkit-backdrop-filter: blur(12px);
+  border: 1px solid var(--glass-border);
+  box-shadow: var(--glass-shadow);
+  border-radius: 0.75rem;
+  padding: 1.5rem;
+  margin-bottom: 1.5rem;
+}
+
+@media (max-width: 640px) {
+  .admin-editor-section {
+    padding: 1rem;
+  }
+}
+
+/* ============================================================================
+   Totals Summary
+   ============================================================================ */
+
+.admin-totals-summary {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-end;
+  gap: 0.25rem;
+  padding-top: 0.75rem;
+  border-top: 1px solid var(--border-color);
+}
+
+.admin-totals-row {
+  display: flex;
+  gap: 2rem;
+  justify-content: flex-end;
+  min-width: 250px;
+  padding: 0.25rem 0;
+  font-size: 0.875rem;
+  color: var(--text-secondary);
+}
+
+.admin-totals-row span:last-child {
+  min-width: 100px;
+  text-align: right;
+  font-weight: 500;
+  color: var(--text-primary);
+}
+
+.admin-totals-total {
+  border-top: 2px solid var(--text-primary);
+  margin-top: 0.25rem;
+  padding-top: 0.5rem;
+  font-size: 1rem;
+  font-weight: 600;
+}
+
+.admin-totals-total span:last-child {
+  font-weight: 700;
+}
+
+@media (max-width: 640px) {
+  .admin-totals-summary {
+    align-items: stretch;
+  }
+
+  .admin-totals-row {
+    min-width: unset;
+  }
+}
+
+/* ============================================================================
+   Scope Sections
+   ============================================================================ */
+
+.admin-scope-list {
+  margin-top: 1.25rem;
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+
+.admin-scope-section {
+  border: 1px solid var(--border-color);
+  border-radius: 0.5rem;
+  overflow: visible;
+  transition: border-color var(--transition);
+  background: var(--bg-primary);
+}
+
+.admin-scope-content {
+  overflow: hidden;
+}
+
+.admin-scope-section:hover {
+  border-color: color-mix(
+    in srgb,
+    var(--border-color) 70%,
+    var(--accent-color)
+  );
+}
+
+.admin-scope-section-header {
+  display: flex;
+  align-items: center;
+  padding: 0.625rem 1rem;
+  background: var(--bg-tertiary);
+  border-bottom: 1px solid var(--border-color);
+  border-radius: 0.5rem 0.5rem 0 0;
+  gap: 0.5rem;
+}
+
+.admin-scope-section-header .admin-scope-number {
+  font-size: 0.75rem;
+  font-weight: 600;
+  color: var(--text-tertiary);
+  flex-shrink: 0;
+  min-width: 1.25rem;
+}
+
+.admin-scope-section-header .admin-scope-title {
+  font-weight: 600;
+  font-size: 0.875rem;
+  color: var(--text-primary);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  flex: 1;
+}
+
+.admin-scope-section-header .admin-scope-actions {
+  display: flex;
+  gap: 0.25rem;
+  margin-left: auto;
+  flex-shrink: 0;
+}
+
+.admin-scope-section .admin-form {
+  padding: 1rem;
+}
+
+/* ============================================================================
+   Logo Section
+   ============================================================================ */
+
+.admin-logo-section {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 1rem;
+  padding: 1rem;
+}
+
+.admin-logo-preview {
+  max-width: 200px;
+  max-height: 100px;
+  border: 1px solid var(--border-color);
+  border-radius: 0.5rem;
+  overflow: hidden;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0.5rem;
+  background: #fff;
+}
+
+.admin-logo-preview img {
+  max-width: 100%;
+  max-height: 80px;
+  object-fit: contain;
+}

src/admin/components/AttendanceShiftTable.tsx

@@ -70,8 +70,11 @@ function renderProjectCell(record: AttendanceRecord): React.ReactNode {
           } else {
             isActive = !log.ended_at;
             const end = log.ended_at ? new Date(log.ended_at) : new Date();
-            const mins = Math.floor(
-              (end.getTime() - new Date(log.started_at!).getTime()) / 60000,
+            const mins = Math.max(
+              0,
+              Math.floor(
+                (end.getTime() - new Date(log.started_at!).getTime()) / 60000,
+              ),
             );
             h = Math.floor(mins / 60);
             m = mins % 60;

src/admin/components/OrderConfirmationModal.tsx

@@ -0,0 +1,382 @@
+import { useState, useCallback } from "react";
+import { motion, AnimatePresence } from "framer-motion";
+
+interface ConfirmationItem {
+  description: string;
+  quantity: number;
+  unit: string;
+  unit_price: number;
+  is_included_in_total: boolean;
+  vat_rate: number;
+}
+
+interface OrderConfirmationModalProps {
+  isOpen: boolean;
+  onClose: () => void;
+  onGenerate: (
+    lang: string,
+    applyVat: boolean,
+    items?: ConfirmationItem[],
+  ) => Promise<void>;
+  initialItems: ConfirmationItem[];
+  orderNumber: string;
+  defaultVatRate: number;
+  applyVat: boolean;
+}
+
+export default function OrderConfirmationModal({
+  isOpen,
+  onClose,
+  onGenerate,
+  initialItems,
+  orderNumber,
+  defaultVatRate,
+  applyVat,
+}: OrderConfirmationModalProps) {
+  const [step, setStep] = useState<"choose" | "edit">("choose");
+  const [lang, setLang] = useState<string>("cs");
+  const [applyVatState, setApplyVatState] = useState(applyVat);
+  const [items, setItems] = useState<ConfirmationItem[]>(initialItems);
+  const [loading, setLoading] = useState(false);
+
+  const handleUseExisting = async () => {
+    setLoading(true);
+    try {
+      await onGenerate(lang, applyVatState, undefined);
+    } finally {
+      setLoading(false);
+      setStep("choose");
+      onClose();
+    }
+  };
+
+  const handleEditGenerate = async () => {
+    setLoading(true);
+    try {
+      await onGenerate(lang, applyVatState, items);
+    } finally {
+      setLoading(false);
+      setStep("choose");
+      onClose();
+    }
+  };
+
+  const updateItem = useCallback(
+    (
+      index: number,
+      field: keyof ConfirmationItem,
+      value: string | number | boolean,
+    ) => {
+      setItems((prev) => {
+        const next = [...prev];
+        next[index] = { ...next[index], [field]: value };
+        return next;
+      });
+    },
+    [],
+  );
+
+  const removeItem = useCallback((index: number) => {
+    setItems((prev) => prev.filter((_, i) => i !== index));
+  }, []);
+
+  const addItem = useCallback(() => {
+    setItems((prev) => [
+      ...prev,
+      {
+        description: "",
+        quantity: 1,
+        unit: "ks",
+        unit_price: 0,
+        is_included_in_total: true,
+        vat_rate: defaultVatRate,
+      },
+    ]);
+  }, [defaultVatRate]);
+
+  return (
+    <AnimatePresence>
+      {isOpen && (
+        <motion.div
+          className="admin-modal-overlay"
+          initial={{ opacity: 0 }}
+          animate={{ opacity: 1 }}
+          exit={{ opacity: 0 }}
+          transition={{ duration: 0.2 }}
+        >
+          <div className="admin-modal-backdrop" onClick={onClose} />
+          <motion.div
+            className={
+              step === "edit" ? "admin-modal admin-modal-lg" : "admin-modal"
+            }
+            initial={{ opacity: 0, scale: 0.95, y: 20 }}
+            animate={{ opacity: 1, scale: 1, y: 0 }}
+            exit={{ opacity: 0, scale: 0.95, y: 20 }}
+            transition={{ duration: 0.2 }}
+          >
+            <div className="admin-modal-header">
+              <h2 className="admin-modal-title">
+                Potvrzení objednávky {orderNumber}
+              </h2>
+            </div>
+
+            <div className="admin-modal-body">
+              {step === "choose" ? (
+                <div className="admin-form">
+                  <div className="admin-form-group">
+                    <label className="admin-form-label">Jazyk dokumentu</label>
+                    <div className="flex-row gap-2">
+                      <button
+                        type="button"
+                        onClick={() => setLang("cs")}
+                        className={
+                          lang === "cs"
+                            ? "admin-btn admin-btn-primary admin-btn-sm"
+                            : "admin-btn admin-btn-secondary admin-btn-sm"
+                        }
+                      >
+                        Čeština
+                      </button>
+                      <button
+                        type="button"
+                        onClick={() => setLang("en")}
+                        className={
+                          lang === "en"
+                            ? "admin-btn admin-btn-primary admin-btn-sm"
+                            : "admin-btn admin-btn-secondary admin-btn-sm"
+                        }
+                      >
+                        English
+                      </button>
+                    </div>
+                  </div>
+
+                  <div className="admin-form-group">
+                    <label className="admin-form-label">DPH</label>
+                    <div className="flex-row gap-2">
+                      <button
+                        type="button"
+                        onClick={() => setApplyVatState(true)}
+                        className={
+                          applyVatState
+                            ? "admin-btn admin-btn-primary admin-btn-sm"
+                            : "admin-btn admin-btn-secondary admin-btn-sm"
+                        }
+                      >
+                        S DPH
+                      </button>
+                      <button
+                        type="button"
+                        onClick={() => setApplyVatState(false)}
+                        className={
+                          !applyVatState
+                            ? "admin-btn admin-btn-primary admin-btn-sm"
+                            : "admin-btn admin-btn-secondary admin-btn-sm"
+                        }
+                      >
+                        Bez DPH
+                      </button>
+                    </div>
+                  </div>
+
+                  <div className="admin-form-group">
+                    <label className="admin-form-label">Obsah potvrzení</label>
+                    <p
+                      className="text-secondary"
+                      style={{ marginBottom: "0.75rem" }}
+                    >
+                      Jak chcete připravit potvrzení objednávky?
+                    </p>
+                    <button
+                      onClick={handleUseExisting}
+                      disabled={loading}
+                      className="admin-btn admin-btn-primary w-full"
+                      style={{ marginBottom: "0.5rem" }}
+                    >
+                      {loading ? (
+                        <>
+                          <div className="admin-spinner admin-spinner-sm" />
+                          Generuji...
+                        </>
+                      ) : (
+                        "Použít položky z objednávky"
+                      )}
+                    </button>
+                    <button
+                      onClick={() => {
+                        setItems(initialItems.length > 0 ? initialItems : []);
+                        setStep("edit");
+                      }}
+                      disabled={loading}
+                      className="admin-btn admin-btn-secondary w-full"
+                    >
+                      Upravit položky
+                    </button>
+                  </div>
+                </div>
+              ) : (
+                <div className="admin-form">
+                  <div className="admin-table-responsive">
+                    <table className="admin-table">
+                      <thead>
+                        <tr>
+                          <th>Popis</th>
+                          <th>Mn.</th>
+                          <th>Jedn.</th>
+                          <th>Cena</th>
+                          <th>%DPH</th>
+                          <th style={{ width: "40px" }} />
+                        </tr>
+                      </thead>
+                      <tbody>
+                        {items.map((item, i) => (
+                          <tr key={i}>
+                            <td>
+                              <input
+                                type="text"
+                                value={item.description}
+                                onChange={(e) =>
+                                  updateItem(i, "description", e.target.value)
+                                }
+                                className="admin-form-input"
+                                style={{ minWidth: "200px" }}
+                              />
+                            </td>
+                            <td>
+                              <input
+                                type="number"
+                                value={item.quantity}
+                                onChange={(e) =>
+                                  updateItem(
+                                    i,
+                                    "quantity",
+                                    Number(e.target.value) || 0,
+                                  )
+                                }
+                                className="admin-form-input"
+                                style={{ width: "80px" }}
+                                step="0.001"
+                              />
+                            </td>
+                            <td>
+                              <input
+                                type="text"
+                                value={item.unit}
+                                onChange={(e) =>
+                                  updateItem(i, "unit", e.target.value)
+                                }
+                                className="admin-form-input"
+                                style={{ width: "60px" }}
+                              />
+                            </td>
+                            <td>
+                              <input
+                                type="number"
+                                value={item.unit_price}
+                                onChange={(e) =>
+                                  updateItem(
+                                    i,
+                                    "unit_price",
+                                    Number(e.target.value) || 0,
+                                  )
+                                }
+                                className="admin-form-input"
+                                style={{ width: "100px" }}
+                                step="0.01"
+                              />
+                            </td>
+                            <td>
+                              <input
+                                type="number"
+                                value={item.vat_rate}
+                                onChange={(e) =>
+                                  updateItem(
+                                    i,
+                                    "vat_rate",
+                                    Number(e.target.value) || 0,
+                                  )
+                                }
+                                className="admin-form-input"
+                                style={{ width: "70px" }}
+                                step="1"
+                              />
+                            </td>
+                            <td>
+                              <button
+                                onClick={() => removeItem(i)}
+                                className="admin-btn-icon danger"
+                                title="Odstranit"
+                              >
+                                <svg
+                                  width="16"
+                                  height="16"
+                                  viewBox="0 0 24 24"
+                                  fill="none"
+                                  stroke="currentColor"
+                                  strokeWidth="2"
+                                >
+                                  <polyline points="3 6 5 6 21 6" />
+                                  <path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2" />
+                                </svg>
+                              </button>
+                            </td>
+                          </tr>
+                        ))}
+                      </tbody>
+                    </table>
+                  </div>
+                  <button
+                    onClick={addItem}
+                    className="admin-btn admin-btn-secondary admin-btn-sm"
+                  >
+                    + Přidat položku
+                  </button>
+                </div>
+              )}
+            </div>
+
+            <div className="admin-modal-footer">
+              {step === "edit" && (
+                <>
+                  <button
+                    type="button"
+                    onClick={() => setStep("choose")}
+                    className="admin-btn admin-btn-secondary"
+                    disabled={loading}
+                  >
+                    Zpět
+                  </button>
+                  <button
+                    type="button"
+                    onClick={handleEditGenerate}
+                    className="admin-btn admin-btn-primary"
+                    disabled={loading || items.length === 0}
+                  >
+                    {loading ? (
+                      <>
+                        <div className="admin-spinner admin-spinner-sm" />
+                        Generuji...
+                      </>
+                    ) : (
+                      "Vygenerovat PDF"
+                    )}
+                  </button>
+                </>
+              )}
+              {step === "choose" && (
+                <button
+                  type="button"
+                  onClick={onClose}
+                  className="admin-btn admin-btn-secondary"
+                  disabled={loading}
+                >
+                  Zrušit
+                </button>
+              )}
+            </div>
+          </motion.div>
+        </motion.div>
+      )}
+    </AnimatePresence>
+  );
+}

src/admin/components/RichEditor.tsx

@@ -1,66 +1,7 @@
-import { useMemo, useRef, useCallback } from "react";
+import { useMemo, useRef, useCallback, useEffect } from "react";
 import ReactQuill from "react-quill-new";
 import "react-quill-new/dist/quill.snow.css";
 
-const Quill = ReactQuill.Quill;
-
-if (!(Quill as any).__bohaRegistered) {
-  const Font = Quill.import("attributors/class/font") as any;
-  Font.whitelist = [
-    "arial",
-    "tahoma",
-    "verdana",
-    "georgia",
-    "times-new-roman",
-    "courier-new",
-    "trebuchet-ms",
-    "impact",
-    "comic-sans-ms",
-    "lucida-console",
-    "palatino-linotype",
-    "garamond",
-  ];
-  Quill.register(Font, true);
-
-  const SizeStyle = Quill.import("attributors/style/size") as any;
-  SizeStyle.whitelist = [
-    "8px",
-    "9px",
-    "10px",
-    "11px",
-    "12px",
-    "14px",
-    "16px",
-    "18px",
-    "20px",
-    "24px",
-    "28px",
-    "32px",
-    "36px",
-    "48px",
-  ];
-  Quill.register(SizeStyle, true);
-  (Quill as any).__bohaRegistered = true;
-}
-
-const Font = Quill.import("attributors/class/font") as any;
-const SIZE_WHITELIST = [
-  "8px",
-  "9px",
-  "10px",
-  "11px",
-  "12px",
-  "14px",
-  "16px",
-  "18px",
-  "20px",
-  "24px",
-  "28px",
-  "32px",
-  "36px",
-  "48px",
-];
-
 const COLORS = [
   "#000000",
   "#1a1a1a",
@@ -95,8 +36,6 @@ const COLORS = [
 ];
 
 const TOOLBAR = [
-  [{ font: Font.whitelist }],
-  [{ size: SIZE_WHITELIST }],
   ["bold", "italic", "underline", "strike"],
   [{ color: COLORS }, { background: COLORS }],
   [{ list: "ordered" }, { list: "bullet" }],
@@ -107,8 +46,6 @@ const TOOLBAR = [
 ];
 
 const FORMATS = [
-  "font",
-  "size",
   "bold",
   "italic",
   "underline",
@@ -159,9 +96,16 @@ export default function RichEditor({
     [onChange],
   );
 
+  useEffect(() => {
+    if (!quillRef.current) return;
+    const editor = quillRef.current.getEditor();
+    editor.format("font", "tahoma");
+    editor.format("size", "14px");
+  }, []);
+
   return (
     <div
-      className="rich-editor"
+      className="admin-rich-editor"
       style={{ "--re-min-height": minHeight } as React.CSSProperties}
     >
       <ReactQuill

src/admin/components/Sidebar.tsx

@@ -330,22 +330,6 @@ const menuSections: MenuSection[] = [
           </svg>
         ),
       },
-      {
-        path: "/company/settings",
-        label: "Firma",
-        permission: "offers.settings",
-        icon: (
-          <svg
-            viewBox="0 0 24 24"
-            fill="none"
-            stroke="currentColor"
-            strokeWidth="2"
-          >
-            <path d="M3 9l9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z" />
-            <polyline points="9 22 9 12 15 12 15 22" />
-          </svg>
-        ),
-      },
     ],
   },
   {
@@ -372,7 +356,7 @@ const menuSections: MenuSection[] = [
       {
         path: "/settings",
         label: "Nastavení",
-        permission: ["settings.roles", "settings.security"],
+        permission: "settings.manage",
         icon: (
           <svg
             viewBox="0 0 24 24"
@@ -464,11 +448,17 @@ export default function Sidebar({ isOpen, onClose, onLogout }: SidebarProps) {
           <img
             src={
               theme === "dark"
-                ? "/images/logo-dark.png"
-                : "/images/logo-light.png"
+                ? "/api/admin/company-settings/logo?variant=dark"
+                : "/api/admin/company-settings/logo?variant=light"
             }
             alt="Logo"
             className="admin-sidebar-logo"
+            onError={(e) => {
+              (e.target as HTMLImageElement).src =
+                theme === "dark"
+                  ? "/images/logo-dark.png"
+                  : "/images/logo-light.png";
+            }}
           />
           <button
             onClick={onClose}

src/admin/components/dashboard/DashKpiCards.tsx

@@ -109,10 +109,10 @@ function buildInvoiceKpi(invoices: InvoicesData): KpiCard {
 }
 
 const KPI_CLASS_MAP: Record<number, string> = {
-  4: "dash-kpi-4",
-  3: "dash-kpi-3",
-  2: "dash-kpi-2",
-  1: "dash-kpi-1",
+  4: "admin-kpi-4",
+  3: "admin-kpi-3",
+  2: "admin-kpi-2",
+  1: "admin-kpi-1",
 };
 
 export default function DashKpiCards({ dashData }: DashKpiCardsProps) {
@@ -121,11 +121,11 @@ export default function DashKpiCards({ dashData }: DashKpiCardsProps) {
     return null;
   }
 
-  const kpiClass = KPI_CLASS_MAP[Math.min(kpiCards.length, 4)] || "dash-kpi-4";
+  const kpiClass = KPI_CLASS_MAP[Math.min(kpiCards.length, 4)] || "admin-kpi-4";
 
   return (
     <motion.div
-      className={`dash-kpi-grid ${kpiClass}`}
+      className={`admin-kpi-grid ${kpiClass}`}
       initial={{ opacity: 0, y: 12 }}
       animate={{ opacity: 1, y: 0 }}
       transition={{ duration: 0.25, delay: 0.06 }}

src/admin/components/dashboard/DashSessions.tsx

@@ -218,17 +218,17 @@ export default function DashSessions() {
             </div>
           )}
           {!sessionsLoading && sessions.length > 0 && (
-            <div className="sessions-list">
+            <div className="dash-sessions-list">
               {sessions.map((session) => (
                 <div
                   key={session.id}
-                  className={`session-item ${session.is_current ? "session-item-current" : ""}`}
+                  className={`dash-session-item ${session.is_current ? "dash-session-item-current" : ""}`}
                 >
-                  <div className="session-icon">
+                  <div className="dash-session-icon">
                     {getDeviceIcon(session.device_info?.icon)}
                   </div>
-                  <div className="session-info">
-                    <div className="session-device">
+                  <div className="dash-session-info">
+                    <div className="dash-session-device">
                       {session.device_info?.browser} na{" "}
                       {session.device_info?.os}
                       {session.is_current && (
@@ -240,13 +240,13 @@ export default function DashSessions() {
                         </span>
                       )}
                     </div>
-                    <div className="session-meta">
+                    <div className="dash-session-meta">
                       <span>{session.ip_address}</span>
-                      <span className="session-meta-separator">|</span>
+                      <span className="dash-session-meta-separator">|</span>
                       <span>{formatSessionDate(session.created_at)}</span>
                     </div>
                   </div>
-                  <div className="session-actions">
+                  <div className="dash-session-actions">
                     {!session.is_current && (
                       <button
                         onClick={() =>

src/admin/dashboard.css

@@ -1,103 +1,3 @@
-/* ============================================================================
-   Stat Cards
-   ============================================================================ */
-
-.admin-stat-card {
-  position: relative;
-  background: var(--glass-bg);
-  backdrop-filter: blur(12px);
-  -webkit-backdrop-filter: blur(12px);
-  border: 1px solid var(--glass-border);
-  box-shadow: var(--glass-shadow);
-  border-radius: var(--border-radius);
-  padding: 1.25rem;
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-  overflow: hidden;
-}
-
-.admin-stat-card::before {
-  content: "";
-  position: absolute;
-  top: 0;
-  left: 0;
-  right: 0;
-  height: 3px;
-  background: var(--accent-color);
-  border-radius: var(--border-radius) var(--border-radius) 0 0;
-}
-
-.admin-stat-card.success::before {
-  background: var(--success);
-}
-.admin-stat-card.warning::before {
-  background: var(--warning);
-}
-.admin-stat-card.danger::before {
-  background: var(--danger);
-}
-.admin-stat-card.info::before {
-  background: var(--info);
-}
-
-.admin-stat-icon {
-  width: 40px;
-  height: 40px;
-  border-radius: var(--border-radius-sm);
-  background: var(--accent-soft);
-  color: var(--accent-color);
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  flex-shrink: 0;
-}
-
-.admin-stat-content {
-  display: flex;
-  flex-direction: column;
-  gap: 0.125rem;
-}
-
-.admin-stat-value {
-  font-size: 28px;
-  font-weight: 700;
-  color: var(--text-primary);
-  font-family: var(--font-mono);
-  letter-spacing: -0.02em;
-  line-height: 1.2;
-}
-
-.admin-stat-label {
-  font-size: 0.6875rem;
-  font-weight: 600;
-  color: var(--text-muted);
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
-}
-
-.admin-stat-footer {
-  font-size: 0.75rem;
-  color: var(--text-secondary);
-}
-
-.admin-stat-icon.danger {
-  background: var(--danger-soft);
-  color: var(--danger);
-}
-.admin-stat-icon.info {
-  background: var(--info-soft);
-  color: var(--info);
-}
-.admin-stat-icon.success {
-  background: var(--success-soft);
-  color: var(--success);
-}
-.admin-stat-icon.warning {
-  background: var(--warning-soft);
-  color: var(--warning);
-}
-
 /* ============================================================================
    Dashboard
    ============================================================================ */
@@ -113,26 +13,6 @@
   margin-bottom: 0;
 }
 
-/* KPI grid */
-.dash-kpi-grid {
-  display: grid;
-  gap: 0.875rem;
-}
-
-.dash-kpi-4 {
-  grid-template-columns: repeat(4, 1fr);
-}
-.dash-kpi-3 {
-  grid-template-columns: repeat(3, 1fr);
-}
-.dash-kpi-2 {
-  grid-template-columns: repeat(2, 1fr);
-}
-.dash-kpi-1 {
-  grid-template-columns: 1fr;
-  max-width: 320px;
-}
-
 /* Quick actions */
 .dash-quick-actions {
   display: grid;
@@ -512,16 +392,9 @@
     display: grid;
     grid-template-columns: 1fr 1fr;
   }
-
-  .dash-kpi-4 {
-    grid-template-columns: repeat(2, 1fr);
-  }
 }
 
 @media (max-width: 768px) {
-  .dash-kpi-grid {
-    grid-template-columns: repeat(2, 1fr);
-  }
   .dash-quick-actions {
     grid-template-columns: repeat(2, 1fr);
   }
@@ -543,9 +416,6 @@
   .dash-quick-actions {
     grid-template-columns: 1fr 1fr;
   }
-  .dash-kpi-grid {
-    grid-template-columns: 1fr;
-  }
   .dash-profile-grid {
     grid-template-columns: 1fr;
   }
@@ -555,12 +425,12 @@
    Sessions / Devices
    ============================================================================ */
 
-.sessions-list {
+.dash-sessions-list {
   display: flex;
   flex-direction: column;
 }
 
-.session-item {
+.dash-session-item {
   display: flex;
   align-items: center;
   gap: 1rem;
@@ -569,23 +439,23 @@
   transition: var(--transition);
 }
 
-.session-item:last-child {
+.dash-session-item:last-child {
   border-bottom: none;
 }
 
-.session-item:hover {
+.dash-session-item:hover {
   background: var(--bg-tertiary);
 }
 
-.session-item-current {
+.dash-session-item-current {
   background: var(--row-current);
 }
 
-.session-item-current:hover {
+.dash-session-item-current:hover {
   background: var(--row-current-hover);
 }
 
-.session-icon {
+.dash-session-icon {
   width: 40px;
   height: 40px;
   border-radius: var(--border-radius-sm);
@@ -597,17 +467,17 @@
   flex-shrink: 0;
 }
 
-.session-item-current .session-icon {
+.dash-session-item-current .dash-session-icon {
   background: color-mix(in srgb, var(--success) 15%, transparent);
   color: var(--success);
 }
 
-.session-info {
+.dash-session-info {
   flex: 1;
   min-width: 0;
 }
 
-.session-device {
+.dash-session-device {
   font-weight: 500;
   color: var(--text-primary);
   display: flex;
@@ -616,7 +486,7 @@
   gap: 0.25rem;
 }
 
-.session-meta {
+.dash-session-meta {
   font-size: 0.8125rem;
   color: var(--text-muted);
   margin-top: 0.25rem;
@@ -626,30 +496,30 @@
   gap: 0.5rem;
 }
 
-.session-meta-separator {
+.dash-session-meta-separator {
   color: var(--border-color);
 }
 
-.session-actions {
+.dash-session-actions {
   flex-shrink: 0;
 }
 
 @media (max-width: 640px) {
-  .session-item {
+  .dash-session-item {
     padding: 1rem;
     gap: 0.75rem;
   }
 
-  .session-icon {
+  .dash-session-icon {
     width: 36px;
     height: 36px;
   }
 
-  .session-device {
+  .dash-session-device {
     font-size: 0.875rem;
   }
 
-  .session-meta {
+  .dash-session-meta {
     font-size: 0.75rem;
   }
 }

src/admin/datepicker.css

@@ -0,0 +1,199 @@
+/* ============================================================================
+   React DatePicker Overrides
+   ============================================================================ */
+
+.react-datepicker-wrapper {
+  width: 100%;
+}
+
+.react-datepicker-popper {
+  z-index: 100 !important;
+}
+
+/* Prevent flash at top-left before popper calculates position */
+#datepicker-portal .react-datepicker-popper {
+  opacity: 0;
+  animation: dp-fade-in 0.01s forwards 0.02s;
+}
+
+@keyframes dp-fade-in {
+  to {
+    opacity: 1;
+  }
+}
+
+.react-datepicker {
+  font-family: inherit !important;
+  background-color: var(--bg-secondary) !important;
+  border: 1px solid var(--border-color) !important;
+  border-radius: var(--border-radius-sm) !important;
+  box-shadow: 0 8px 32px rgba(0, 0, 0, 0.25) !important;
+  color: var(--text-primary) !important;
+  font-size: 0.875rem !important;
+}
+
+.react-datepicker__triangle {
+  display: none !important;
+}
+
+/* Header */
+.react-datepicker__header {
+  background-color: var(--bg-tertiary) !important;
+  border-bottom: 1px solid var(--border-color) !important;
+  padding-top: 0.75rem !important;
+}
+
+.react-datepicker__current-month,
+.react-datepicker-time__header {
+  color: var(--text-primary) !important;
+  font-weight: 600 !important;
+}
+
+.react-datepicker__day-name {
+  color: var(--text-secondary) !important;
+}
+
+/* Days */
+.react-datepicker__day {
+  color: var(--text-primary) !important;
+  border-radius: 6px !important;
+  transition:
+    background 0.15s,
+    color 0.15s !important;
+}
+
+.react-datepicker__day:hover {
+  background-color: var(--accent-light) !important;
+  color: var(--text-primary) !important;
+}
+
+.react-datepicker__day--selected,
+.react-datepicker__day--keyboard-selected {
+  background-color: var(--accent-color) !important;
+  color: #fff !important;
+}
+
+.react-datepicker__day--today {
+  font-weight: 700 !important;
+}
+
+.react-datepicker__day--outside-month {
+  color: var(--text-muted) !important;
+  opacity: 0.5;
+}
+
+.react-datepicker__day--disabled {
+  color: var(--text-muted) !important;
+  opacity: 0.3 !important;
+}
+
+/* Navigation arrows */
+.react-datepicker__navigation {
+  top: 0.75rem !important;
+}
+
+.react-datepicker__navigation-icon::before {
+  border-color: var(--text-secondary) !important;
+}
+
+.react-datepicker__navigation:hover *::before {
+  border-color: var(--accent-color) !important;
+}
+
+/* Year dropdown */
+.react-datepicker__year-dropdown,
+.react-datepicker__month-dropdown,
+.react-datepicker__year-read-view,
+.react-datepicker__month-read-view {
+  color: var(--text-primary) !important;
+}
+
+/* Time picker */
+.react-datepicker__time-container {
+  border-left: 1px solid var(--border-color) !important;
+}
+
+.react-datepicker__time-container .react-datepicker__time {
+  background-color: var(--bg-secondary) !important;
+}
+
+.react-datepicker__time-container
+  .react-datepicker__time
+  .react-datepicker__time-box {
+  width: 100% !important;
+}
+
+.react-datepicker__time-container
+  .react-datepicker__time
+  .react-datepicker__time-box
+  ul.react-datepicker__time-list
+  li.react-datepicker__time-list-item {
+  color: var(--text-primary) !important;
+  transition: background 0.15s !important;
+}
+
+.react-datepicker__time-container
+  .react-datepicker__time
+  .react-datepicker__time-box
+  ul.react-datepicker__time-list
+  li.react-datepicker__time-list-item:hover {
+  background-color: var(--accent-light) !important;
+  color: var(--text-primary) !important;
+}
+
+.react-datepicker__time-container
+  .react-datepicker__time
+  .react-datepicker__time-box
+  ul.react-datepicker__time-list
+  li.react-datepicker__time-list-item--selected {
+  background-color: var(--accent-color) !important;
+  color: #fff !important;
+  font-weight: 600 !important;
+}
+
+/* Month picker */
+.react-datepicker__monthPicker {
+  background-color: var(--bg-secondary) !important;
+}
+
+.react-datepicker-year-header {
+  background-color: var(--bg-tertiary) !important;
+  color: var(--text-primary) !important;
+  border-bottom: 1px solid var(--border-color) !important;
+}
+
+.react-datepicker__month-wrapper {
+  background-color: var(--bg-secondary) !important;
+}
+
+.react-datepicker__month-text {
+  color: var(--text-primary) !important;
+  padding: 0.5rem !important;
+  border-radius: 6px !important;
+  transition: background 0.15s !important;
+  background-color: transparent !important;
+}
+
+.react-datepicker__month-text:hover {
+  background-color: var(--accent-light) !important;
+  color: var(--text-primary) !important;
+}
+
+.react-datepicker__month-text--keyboard-selected,
+.react-datepicker__month-text--selected {
+  background-color: var(--accent-color) !important;
+  color: #fff !important;
+}
+
+.react-datepicker__month-text--today {
+  font-weight: 700 !important;
+}
+
+/* Input */
+.react-datepicker__input-container input {
+  cursor: pointer;
+}
+
+.react-datepicker__close-icon::after {
+  background-color: var(--accent-color) !important;
+}

src/admin/filemanager.css

@@ -0,0 +1,171 @@
+/* ============================================================================
+   File Manager
+   ============================================================================ */
+
+.fm-toolbar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  margin-bottom: 0.75rem;
+  flex-wrap: wrap;
+}
+
+.fm-full-path {
+  font-family: var(--font-mono);
+  font-size: 11px;
+  color: var(--text-tertiary);
+  user-select: all;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  max-width: 100%;
+}
+
+.fm-toolbar-actions {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+}
+
+.fm-breadcrumb {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 0;
+  font-size: 12px;
+  min-height: 28px;
+}
+
+.fm-breadcrumb-segment {
+  display: inline-flex;
+  align-items: center;
+}
+
+.fm-breadcrumb-sep {
+  color: var(--text-tertiary);
+  margin: 0 4px;
+  user-select: none;
+}
+
+.fm-breadcrumb-btn {
+  background: none;
+  border: none;
+  padding: 2px 6px;
+  border-radius: 4px;
+  color: var(--text-secondary);
+  cursor: pointer;
+  font-family: var(--font-mono);
+  font-size: 12px;
+  transition: all 0.15s ease;
+}
+
+.fm-breadcrumb-btn:hover {
+  background: var(--bg-tertiary);
+  color: var(--text-primary);
+}
+
+.fm-breadcrumb-btn.active {
+  color: var(--text-primary);
+  font-weight: 600;
+}
+
+.fm-new-folder {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+  margin-bottom: 0.75rem;
+}
+
+.fm-new-folder .admin-form-input {
+  max-width: 250px;
+}
+
+.fm-content {
+  position: relative;
+  border-radius: var(--border-radius-sm);
+  transition: border-color 0.2s ease;
+}
+
+.fm-content.fm-drag-over {
+  border: 2px dashed var(--accent-color);
+  background: var(--accent-light);
+}
+
+.fm-dropzone-overlay {
+  position: absolute;
+  inset: 0;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 0.5rem;
+  background: color-mix(in srgb, var(--bg-primary) 90%, transparent);
+  border-radius: var(--border-radius-sm);
+  z-index: 5;
+  color: var(--accent-color);
+  font-size: 13px;
+  font-weight: 500;
+  pointer-events: none;
+}
+
+.fm-empty {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 0.5rem;
+  padding: 2.5rem 1rem;
+  color: var(--text-tertiary);
+  font-size: 13px;
+}
+
+.fm-folder-link {
+  background: none;
+  border: none;
+  padding: 0;
+  color: var(--accent-color);
+  font-weight: 500;
+  font-size: inherit;
+  font-family: inherit;
+  cursor: pointer;
+}
+
+.fm-folder-link:hover {
+  text-decoration: underline;
+}
+
+.fm-item-count {
+  font-size: 10px;
+  color: var(--text-tertiary);
+  font-weight: 400;
+}
+
+.fm-file-name {
+  color: var(--text-primary);
+}
+
+.fm-meta {
+  color: var(--text-secondary);
+  font-family: var(--font-mono);
+  font-size: 11px;
+}
+
+.fm-actions {
+  display: inline-flex;
+  gap: 2px;
+  justify-content: flex-end;
+}
+
+.fm-name-cell {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+}
+
+.fm-symlink-badge {
+  display: inline-flex;
+  align-items: center;
+  color: var(--text-tertiary);
+  cursor: help;
+}

src/admin/forms.css

@@ -0,0 +1,488 @@
+/* ============================================================================
+   Forms
+   ============================================================================ */
+
+.admin-form {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+}
+
+.admin-form-group {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.admin-form-label {
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--text-secondary);
+}
+
+.admin-form-input {
+  width: 100%;
+  padding: 9px 12px;
+  background: var(--input-bg);
+  border: 1px solid var(--border-color);
+  border-radius: var(--border-radius-sm);
+  color: var(--text-primary);
+  font-size: 13px;
+  font-family: inherit;
+  outline: none;
+  transition:
+    border-color 0.3s cubic-bezier(0.4, 0, 0.2, 1),
+    box-shadow 0.3s cubic-bezier(0.4, 0, 0.2, 1);
+  box-sizing: border-box;
+  min-height: 36px;
+}
+
+.admin-form-input:focus {
+  border-color: var(--accent-color);
+  box-shadow: 0 0 0 3px var(--accent-light);
+}
+
+.admin-form-input::placeholder {
+  color: var(--text-muted);
+}
+
+.admin-form-input[type="date"],
+.admin-form-input[type="time"],
+.admin-form-input[type="month"],
+.admin-form-input[type="number"] {
+  -webkit-appearance: none;
+  -moz-appearance: none;
+  appearance: none;
+  text-align: left;
+  height: 36px;
+  max-width: 100%;
+}
+
+.admin-form-input[type="number"]::-webkit-inner-spin-button,
+.admin-form-input[type="number"]::-webkit-outer-spin-button {
+  -webkit-appearance: none;
+  margin: 0;
+}
+
+.admin-form-input[type="date"]::-webkit-date-and-time-value,
+.admin-form-input[type="time"]::-webkit-date-and-time-value,
+.admin-form-input[type="month"]::-webkit-date-and-time-value {
+  text-align: left;
+  margin: 0;
+}
+
+.admin-form-input[type="date"]::-webkit-datetime-edit,
+.admin-form-input[type="time"]::-webkit-datetime-edit,
+.admin-form-input[type="month"]::-webkit-datetime-edit {
+  padding: 0;
+}
+
+.admin-form-input[type="date"]::-webkit-calendar-picker-indicator,
+.admin-form-input[type="time"]::-webkit-calendar-picker-indicator,
+.admin-form-input[type="month"]::-webkit-calendar-picker-indicator {
+  filter: var(--calendar-icon-filter, none);
+  cursor: pointer;
+}
+
+/* Select */
+.admin-form-select {
+  width: 100%;
+  padding: 9px 12px;
+  background: var(--input-bg);
+  border: 1px solid var(--border-color);
+  border-radius: var(--border-radius-sm);
+  color: var(--text-primary);
+  font-size: 13px;
+  font-family: inherit;
+  outline: none;
+  transition:
+    border-color 0.3s cubic-bezier(0.4, 0, 0.2, 1),
+    box-shadow 0.3s cubic-bezier(0.4, 0, 0.2, 1);
+  min-height: 36px;
+  box-sizing: border-box;
+  cursor: pointer;
+  appearance: none;
+  background-image: var(--select-arrow);
+  background-repeat: no-repeat;
+  background-position: right 0.75rem center;
+  padding-right: 32px;
+}
+
+.admin-form-select:focus {
+  border-color: var(--accent-color);
+  box-shadow: 0 0 0 3px var(--accent-light);
+}
+
+.admin-form-select option {
+  background: var(--bg-secondary);
+  color: var(--text-primary);
+}
+
+/* Textarea */
+.admin-form-textarea {
+  width: 100%;
+  padding: 9px 12px;
+  background: var(--input-bg);
+  border: 1px solid var(--border-color);
+  border-radius: var(--border-radius-sm);
+  color: var(--text-primary);
+  font-size: 13px;
+  font-family: inherit;
+  outline: none;
+  transition:
+    border-color 0.3s cubic-bezier(0.4, 0, 0.2, 1),
+    box-shadow 0.3s cubic-bezier(0.4, 0, 0.2, 1);
+  resize: vertical;
+  box-sizing: border-box;
+  min-height: 80px;
+}
+
+.admin-form-textarea:focus {
+  border-color: var(--accent-color);
+  box-shadow: 0 0 0 3px var(--accent-light);
+}
+
+/* Checkbox */
+.admin-form-checkbox {
+  display: inline-flex;
+  align-items: flex-start;
+  gap: 0;
+  cursor: pointer;
+  user-select: none;
+}
+
+.admin-form-checkbox input {
+  position: absolute;
+  opacity: 0;
+  width: 0;
+  height: 0;
+  pointer-events: none;
+}
+
+.admin-form-checkbox input + span::before {
+  content: "";
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 16px;
+  height: 16px;
+  margin-right: 8px;
+  background: var(--input-bg);
+  border: 1px solid var(--border-color);
+  border-radius: 4px;
+  vertical-align: middle;
+  transition:
+    border-color var(--transition),
+    box-shadow var(--transition),
+    background var(--transition);
+  flex-shrink: 0;
+}
+
+.admin-form-checkbox input:checked + span::before {
+  background: var(--accent-color);
+  border-color: var(--accent-color);
+  background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='white' stroke-width='3' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpolyline points='20 6 9 17 4 12'%3E%3C/polyline%3E%3C/svg%3E");
+  background-size: 12px;
+  background-position: center;
+  background-repeat: no-repeat;
+}
+
+.admin-form-checkbox input:focus + span::before {
+  border-color: var(--accent-color);
+  box-shadow: 0 0 0 3px var(--accent-light);
+}
+
+.admin-form-checkbox:hover
+  input:not(:checked):not(:disabled):not(:indeterminate)
+  + span::before {
+  border-color: var(--border-color-hover);
+  background: var(--bg-secondary);
+}
+
+.admin-form-checkbox input:indeterminate + span::before {
+  background: var(--accent-color);
+  border-color: var(--accent-color);
+  background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='white' stroke-width='3' stroke-linecap='round'%3E%3Cline x1='6' y1='12' x2='18' y2='12'%3E%3C/line%3E%3C/svg%3E");
+  background-size: 12px;
+  background-position: center;
+  background-repeat: no-repeat;
+}
+
+.admin-form-checkbox input:disabled + span::before {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+.admin-form-checkbox:has(input:disabled) {
+  cursor: not-allowed;
+  opacity: 0.7;
+}
+
+.admin-form-checkbox span {
+  display: flex;
+  align-items: center;
+  font-size: 13px;
+  color: var(--text-secondary);
+  line-height: 1.4;
+}
+
+/* Reorderable List */
+.admin-reorder-list {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+}
+
+.admin-reorder-item {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 5px 8px;
+  background: var(--bg-tertiary);
+  border-radius: var(--border-radius-sm);
+}
+
+.admin-reorder-arrows {
+  display: flex;
+  gap: 2px;
+}
+
+.admin-reorder-label {
+  font-size: 13px;
+  color: var(--text-primary);
+}
+
+.admin-reorder-label.accent {
+  color: var(--accent-color);
+}
+
+.admin-reorder-arrows .admin-btn-icon {
+  width: 22px;
+  height: 22px;
+  color: var(--text-muted);
+}
+
+.admin-reorder-arrows .admin-btn-icon:hover:not(:disabled) {
+  background: var(--bg-primary);
+  color: var(--text-primary);
+}
+
+.admin-reorder-arrows .admin-btn-icon:disabled {
+  opacity: 0.25;
+}
+
+/* Form Rows (Grid Layouts) */
+.admin-form-row {
+  display: grid;
+  gap: 1rem;
+  grid-template-columns: repeat(2, 1fr);
+}
+
+.admin-form-row-3 {
+  grid-template-columns: repeat(3, 1fr);
+}
+
+.admin-form-row-4 {
+  grid-template-columns: repeat(4, 1fr);
+}
+
+.admin-form-row-5 {
+  grid-template-columns: 1.2fr 1fr 1fr 1fr 1fr;
+}
+
+@media (max-width: 768px) {
+  .admin-form-row-4 {
+    grid-template-columns: repeat(2, 1fr);
+  }
+  .admin-form-row-5 {
+    grid-template-columns: repeat(3, 1fr);
+  }
+}
+
+@media (max-width: 640px) {
+  .admin-form-row,
+  .admin-form-row-3 {
+    grid-template-columns: 1fr;
+  }
+  .admin-form-row-5 {
+    grid-template-columns: repeat(2, 1fr);
+  }
+}
+
+@media (max-width: 480px) {
+  .admin-form-row-4,
+  .admin-form-row-5 {
+    grid-template-columns: 1fr;
+  }
+}
+
+/* Form Utilities */
+.admin-form-hint {
+  font-size: 0.75rem;
+  color: var(--text-muted);
+  margin-top: 0.25rem;
+}
+
+/* Required field indicator */
+.admin-form-label.required::after {
+  content: " *";
+  color: var(--danger);
+  font-weight: 600;
+}
+
+/* Inline field errors */
+.admin-form-group.has-error .admin-form-input,
+.admin-form-group.has-error .admin-form-select,
+.admin-form-group.has-error .admin-form-textarea {
+  border-color: var(--danger);
+  box-shadow: 0 0 0 3px var(--danger-light);
+}
+
+.admin-form-group.has-error .admin-form-label {
+  color: var(--danger);
+}
+
+.admin-form-error {
+  font-size: 0.75rem;
+  color: var(--danger);
+  margin-top: 0.25rem;
+  display: flex;
+  align-items: center;
+  gap: 0.25rem;
+}
+
+.admin-form-actions {
+  display: flex;
+  gap: 0.75rem;
+  justify-content: flex-end;
+  margin-top: 1.5rem;
+  padding-top: 1.5rem;
+  border-top: 1px solid var(--border-color);
+}
+
+/* Touch targets - min 44px on mobile */
+@media (max-width: 768px) {
+  .admin-form-input,
+  .admin-form-select,
+  .admin-form-textarea {
+    min-height: 44px;
+    font-size: 16px; /* prevent auto-zoom on iOS */
+  }
+
+  .admin-form-checkbox {
+    min-height: 44px;
+    padding: 8px 0;
+  }
+
+  .admin-form-checkbox input + span::before {
+    width: 20px;
+    height: 20px;
+  }
+
+  .admin-form-label {
+    font-size: 13px;
+  }
+}
+
+/* ============================================================================
+   Customer Selector
+   ============================================================================ */
+
+.admin-customer-select {
+  position: relative;
+}
+
+.admin-customer-selected {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  height: 36px;
+  padding: 0 12px;
+  border: 1px solid var(--border-color);
+  border-radius: var(--border-radius-sm);
+  background: var(--input-bg);
+  font-size: 13px;
+  font-weight: 500;
+  color: var(--text-primary);
+}
+
+.admin-customer-selected span {
+  flex: 1;
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-customer-selected .admin-btn-icon {
+  flex-shrink: 0;
+  width: 22px;
+  height: 22px;
+  margin-right: -4px;
+}
+
+.admin-customer-dropdown {
+  position: absolute;
+  top: 100%;
+  left: 0;
+  right: 0;
+  z-index: 100;
+  max-height: 260px;
+  overflow-y: auto;
+  overscroll-behavior: contain;
+  background: var(--bg-primary);
+  border: 1px solid var(--border-color);
+  border-top: none;
+  border-radius: 0 0 var(--border-radius-sm) var(--border-radius-sm);
+  box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);
+  padding: 4px 0;
+}
+
+.admin-customer-dropdown::-webkit-scrollbar {
+  width: 5px;
+}
+
+.admin-customer-dropdown::-webkit-scrollbar-track {
+  background: transparent;
+}
+
+.admin-customer-dropdown::-webkit-scrollbar-thumb {
+  background: var(--border-color);
+  border-radius: 99px;
+}
+
+.admin-customer-dropdown::-webkit-scrollbar-thumb:hover {
+  background: var(--text-muted);
+}
+
+.admin-customer-dropdown-item {
+  padding: 8px 12px;
+  cursor: pointer;
+  transition: background var(--transition);
+  border-radius: 4px;
+  margin: 0 4px;
+}
+
+.admin-customer-dropdown-item:hover {
+  background: var(--bg-secondary);
+}
+
+.admin-customer-dropdown-item div:first-child {
+  font-size: 13px;
+  font-weight: 500;
+  color: var(--text-primary);
+  line-height: 1.3;
+}
+
+.admin-customer-dropdown-item div:last-child {
+  font-size: 11.5px;
+  color: var(--text-tertiary);
+  margin-top: 1px;
+}
+
+.admin-customer-dropdown-empty {
+  padding: 0.75rem;
+  text-align: center;
+  color: var(--text-tertiary);
+  font-size: 0.8125rem;
+}

src/admin/hooks/useAttendanceAdmin.ts

@@ -358,6 +358,7 @@ function buildPrintHtml(
   userSections: string,
   emptyMsg: string,
   filterNote: string,
+  companyName: string,
 ): string {
   return `<!DOCTYPE html>
 <html lang="cs">
@@ -424,10 +425,10 @@ function buildPrintHtml(
     <thead><tr><td>
       <div class="print-header">
         <div class="print-header-left">
-          <img src="/images/logo-light.png" alt="BOHA" class="print-logo" />
+          <img src="/api/admin/company-settings/logo?variant=light" alt="" class="print-logo" />
           <div class="print-header-text">
             <h1>EVIDENCE DOCHÁZKY</h1>
-            <div class="company">BOHA Automation s.r.o.</div>
+            <div class="company">${companyName}</div>
           </div>
         </div>
         <div class="print-header-right">
@@ -560,7 +561,9 @@ export default function useAttendanceAdmin({ alert }: AlertContext) {
   useEffect(() => {
     const loadUsers = async () => {
       try {
-        const response = await apiFetch(`${API_BASE}/users?limit=1000`);
+        const response = await apiFetch(
+          `${API_BASE}/attendance?action=attendance_users`,
+        );
         const result = await response.json();
         if (result.success) {
           const apiUsers: ApiUser[] = result.data;
@@ -1010,9 +1013,16 @@ export default function useAttendanceAdmin({ alert }: AlertContext) {
   // =========================================================================
   const handlePrint = async () => {
     try {
-      let url = `${API_BASE}/attendance?action=print&month=${month}`;
-      if (filterUserId) url += `&user_id=${filterUserId}`;
-      const response = await apiFetch(url);
+      const [response, settingsRes] = await Promise.all([
+        apiFetch(
+          `${API_BASE}/attendance?action=print&month=${month}${filterUserId ? `&user_id=${filterUserId}` : ""}`,
+        ),
+        apiFetch(`${API_BASE}/company-settings`),
+      ]);
+      const settingsData = await settingsRes.json();
+      const companyName = settingsData.success
+        ? settingsData.data.company_name || ""
+        : "";
       if (response.status === 401) return;
       const result = await response.json();
       if (result.success) {
@@ -1034,6 +1044,7 @@ export default function useAttendanceAdmin({ alert }: AlertContext) {
           userSections,
           emptyMsg,
           filterNote,
+          companyName,
         );
         const printWindow = window.open("", "_blank");
         if (printWindow) {

src/admin/layout.css

@@ -0,0 +1,582 @@
+/* ============================================================================
+   Layout
+   ============================================================================ */
+
+.admin-layout {
+  display: flex;
+  min-height: 100vh;
+  min-height: 100dvh;
+  background: var(--bg-primary);
+}
+
+@media (min-width: 1024px) {
+  .admin-layout {
+    align-items: flex-start;
+  }
+}
+
+/* ============================================================================
+   Sidebar
+   ============================================================================ */
+
+/* -- Theme variables for sidebar -- */
+[data-theme="dark"] .admin-sidebar {
+  --sb-bg: #141414;
+  --sb-border: #2a2a2a;
+  --sb-text: #a0a0a0;
+  --sb-text-hover: #ddd;
+  --sb-hover-bg: #1f1f1f;
+  --sb-active-bg: #ffffff;
+  --sb-active-text: #141414;
+  --sb-label: #444;
+  --sb-muted: #555;
+  --sb-scrollbar: #333;
+}
+
+[data-theme="light"] .admin-sidebar {
+  --sb-bg: #ffffff;
+  --sb-border: #e8e6e1;
+  --sb-text: #7c7c84;
+  --sb-text-hover: #1a1a1a;
+  --sb-hover-bg: #f5f4f2;
+  --sb-active-bg: #141414;
+  --sb-active-text: #ffffff;
+  --sb-label: #a0a0a0;
+  --sb-muted: #a0a0a0;
+  --sb-scrollbar: #ddd;
+}
+
+.admin-sidebar {
+  position: fixed;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  width: 100%;
+  height: 100vh;
+  height: 100dvh;
+  z-index: 50;
+  background: var(--sb-bg);
+  border-right: 1px solid var(--sb-border);
+  display: flex;
+  flex-direction: column;
+  padding-top: env(safe-area-inset-top, 0px);
+  padding-bottom: env(safe-area-inset-bottom, 0px);
+  padding-left: env(safe-area-inset-left, 0px);
+  padding-right: env(safe-area-inset-right, 0px);
+  transform: translateX(-100%);
+  visibility: hidden;
+  transition:
+    transform 0.3s ease,
+    visibility 0.3s ease;
+  overflow: hidden;
+  overscroll-behavior: none;
+}
+
+.admin-sidebar.open {
+  transform: translateX(0);
+  visibility: visible;
+  touch-action: none;
+}
+
+@media (min-width: 1024px) {
+  .admin-sidebar {
+    right: auto;
+    width: 220px;
+    height: 100%;
+    transform: none;
+    visibility: visible;
+    padding: 0;
+  }
+}
+
+[data-theme="light"] .admin-sidebar {
+  box-shadow:
+    1px 0 0 0 var(--sb-border),
+    4px 0 16px rgba(0, 0, 0, 0.04);
+}
+
+/* Sidebar Overlay (mobile) */
+.admin-sidebar-overlay {
+  display: none;
+  position: fixed;
+  inset: 0;
+  background: rgba(0, 0, 0, 0.5);
+  z-index: 49;
+  backdrop-filter: blur(2px);
+}
+
+.admin-sidebar-overlay.open {
+  display: block;
+}
+
+@media (min-width: 1024px) {
+  .admin-sidebar-overlay {
+    display: none !important;
+  }
+}
+
+/* Sidebar Header */
+.admin-sidebar-header {
+  padding: 0 18px;
+  height: 73px;
+  border-bottom: 1px solid var(--sb-border);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  flex-shrink: 0;
+}
+
+.admin-sidebar-logo {
+  height: 28px;
+  width: auto;
+}
+
+.admin-sidebar-close {
+  display: block;
+  padding: 0.5rem;
+  background: transparent;
+  border: none;
+  color: var(--sb-text);
+  cursor: pointer;
+  border-radius: 6px;
+}
+
+.admin-sidebar-close:hover {
+  background: var(--sb-hover-bg);
+  color: var(--sb-text-hover);
+}
+
+@media (min-width: 1024px) {
+  .admin-sidebar-close {
+    display: none;
+  }
+}
+
+/* Sidebar Navigation */
+.admin-sidebar-nav {
+  flex: 1;
+  min-height: 0;
+  overflow-y: auto;
+  -webkit-overflow-scrolling: touch;
+  overscroll-behavior: contain;
+  padding: 4px 0;
+}
+
+.admin-sidebar-nav::-webkit-scrollbar {
+  width: 5px;
+}
+
+.admin-sidebar-nav::-webkit-scrollbar-track {
+  background: transparent;
+}
+
+.admin-sidebar-nav::-webkit-scrollbar-thumb {
+  background: var(--sb-scrollbar);
+  border-radius: 99px;
+}
+
+/* Nav Section */
+.admin-nav-section {
+  padding: 14px 10px 6px;
+}
+
+.admin-nav-label {
+  font-size: 10px;
+  font-weight: 600;
+  letter-spacing: 1px;
+  text-transform: uppercase;
+  color: var(--sb-label);
+  padding: 0 8px;
+  margin-bottom: 4px;
+}
+
+/* Nav Item */
+.admin-nav-item {
+  display: flex;
+  align-items: center;
+  gap: 9px;
+  padding: 7px 10px;
+  border-radius: 7px;
+  color: var(--sb-text);
+  cursor: pointer;
+  transition: all 0.15s ease;
+  font-size: 13px;
+  font-weight: 450;
+  margin-bottom: 1px;
+  text-decoration: none;
+  user-select: none;
+}
+
+.admin-nav-item:hover {
+  background: var(--sb-hover-bg);
+  color: var(--sb-text-hover);
+}
+
+.admin-nav-item.active {
+  background: var(--sb-active-bg);
+  color: var(--sb-active-text);
+  font-weight: 600;
+}
+
+.admin-nav-item.active svg {
+  color: var(--accent-color);
+}
+
+.admin-nav-item svg {
+  width: 16px;
+  height: 16px;
+  flex-shrink: 0;
+}
+
+@media (max-width: 1023px) {
+  .admin-nav-item {
+    padding: 10px 12px;
+    font-size: 15px;
+    gap: 10px;
+  }
+
+  .admin-nav-item svg {
+    width: 18px;
+    height: 18px;
+  }
+}
+
+/* Sidebar Footer */
+.admin-sidebar-footer {
+  margin-top: auto;
+  border-top: 1px solid var(--sb-border);
+  padding: 14px 10px;
+  flex-shrink: 0;
+}
+
+.admin-user-chip {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 8px;
+  border-radius: 8px;
+  margin-bottom: 4px;
+}
+
+.admin-user-avatar {
+  width: 32px;
+  height: 32px;
+  border-radius: 50%;
+  background: var(--accent-color);
+  color: #fff;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 12px;
+  flex-shrink: 0;
+}
+
+.admin-user-details {
+  flex: 1;
+  min-width: 0;
+}
+
+.admin-user-name {
+  color: var(--sb-text-hover);
+  font-size: 13px;
+  font-weight: 500;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.admin-user-role {
+  color: var(--sb-muted);
+  font-size: 11px;
+}
+
+.admin-logout-btn {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  width: 100%;
+  padding: 7px 10px;
+  background: transparent;
+  border: none;
+  color: var(--sb-text);
+  cursor: pointer;
+  border-radius: 7px;
+  font-size: 12px;
+  font-family: inherit;
+  transition: all 0.15s ease;
+}
+
+.admin-logout-btn:hover {
+  background: var(--sb-hover-bg);
+  color: var(--sb-text-hover);
+}
+
+.admin-logout-btn svg {
+  width: 16px;
+  height: 16px;
+  flex-shrink: 0;
+}
+
+@media (max-width: 480px) {
+  .admin-sidebar-footer {
+    padding: 10px 8px;
+  }
+
+  .admin-user-chip {
+    padding: 6px;
+  }
+
+  .admin-logout-btn {
+    padding: 8px;
+    font-size: 13px;
+  }
+}
+
+/* ============================================================================
+   Main Content Area
+   ============================================================================ */
+
+.admin-main {
+  flex: 1;
+  min-width: 0;
+  min-height: 100vh;
+  min-height: 100dvh;
+  display: flex;
+  flex-direction: column;
+}
+
+@media (min-width: 1024px) {
+  .admin-main {
+    margin-left: 220px;
+  }
+}
+
+/* Header */
+.admin-header {
+  position: fixed;
+  top: 0;
+  left: 0;
+  right: 0;
+  z-index: 30;
+  height: calc(73px + env(safe-area-inset-top, 0px));
+  background: var(--bg-secondary);
+  border-bottom: 1px solid var(--border-color);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 0 1rem;
+  padding-top: env(safe-area-inset-top, 0px);
+}
+
+@media (min-width: 1024px) {
+  .admin-header {
+    left: 220px;
+    padding: 0 1.5rem;
+  }
+}
+
+.admin-menu-btn {
+  display: block;
+  padding: 0.5rem;
+  background: transparent;
+  border: none;
+  color: var(--text-secondary);
+  cursor: pointer;
+  border-radius: var(--border-radius-sm);
+}
+
+.admin-menu-btn:hover {
+  background: var(--bg-tertiary);
+}
+
+@media (min-width: 1024px) {
+  .admin-menu-btn {
+    display: none;
+  }
+}
+
+.admin-header-theme-btn {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 40px;
+  height: 40px;
+  padding: 0;
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border-color);
+  color: var(--text-secondary);
+  cursor: pointer;
+  border-radius: 50%;
+  transition: var(--transition);
+  position: relative;
+  overflow: hidden;
+}
+
+.admin-header-theme-btn:hover {
+  background: var(--bg-tertiary);
+  border-color: var(--border-color-hover);
+  transform: scale(1.05);
+}
+
+.admin-theme-icon {
+  position: absolute;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  color: var(--text-primary);
+  transition: all 0.3s ease;
+  opacity: 0;
+  transform: rotate(180deg) scale(0.5);
+}
+
+.admin-theme-icon.visible {
+  opacity: 1;
+  transform: rotate(0) scale(1);
+}
+
+/* Content */
+.admin-content {
+  flex: 1;
+  padding: 1rem;
+  padding-top: calc(73px + 1rem + env(safe-area-inset-top, 0px));
+}
+
+@media (min-width: 1024px) {
+  .admin-content {
+    padding: 28px 32px;
+    padding-top: calc(73px + 28px);
+  }
+}
+
+/* ============================================================================
+   Page Headers
+   ============================================================================ */
+
+.admin-page-header {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  margin-bottom: 1rem;
+}
+
+@media (min-width: 640px) {
+  .admin-page-header {
+    flex-direction: row;
+    align-items: center;
+    justify-content: space-between;
+  }
+}
+
+.admin-page-title {
+  font-size: 22px;
+  font-weight: 700;
+  color: var(--text-primary);
+  font-family: var(--font-heading);
+  margin-bottom: 0.25rem;
+}
+
+.admin-page-subtitle {
+  color: var(--text-secondary);
+  font-size: 13px;
+}
+
+.admin-page-actions {
+  display: flex;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+}
+
+@media (max-width: 640px) {
+  .admin-page-actions {
+    width: 100%;
+  }
+
+  .admin-page-actions .admin-btn {
+    flex: 1;
+  }
+}
+
+/* ============================================================================
+   Grid System
+   ============================================================================ */
+
+.admin-grid {
+  display: grid;
+  gap: 1rem;
+}
+
+.admin-grid > .admin-card {
+  margin-bottom: 0;
+}
+
+.admin-grid-3 {
+  grid-template-columns: 1fr;
+}
+
+@media (min-width: 640px) {
+  .admin-grid-3 {
+    grid-template-columns: repeat(2, 1fr);
+  }
+}
+
+@media (min-width: 1024px) {
+  .admin-grid-3 {
+    grid-template-columns: repeat(3, 1fr);
+  }
+}
+
+.admin-grid-4 {
+  grid-template-columns: repeat(2, 1fr);
+}
+
+@media (min-width: 768px) {
+  .admin-grid-4 {
+    grid-template-columns: repeat(4, 1fr);
+  }
+}
+
+/* Page header on mobile */
+@media (max-width: 480px) {
+  .admin-page-title {
+    font-size: 18px;
+  }
+
+  .admin-page-subtitle {
+    font-size: 12px;
+  }
+
+  .admin-content {
+    padding: 12px !important;
+    padding-top: calc(73px + 12px + env(safe-area-inset-top, 0px)) !important;
+  }
+}
+
+/* Grid - single column on small mobile */
+@media (max-width: 480px) {
+  .admin-grid-4 {
+    grid-template-columns: 1fr;
+  }
+}
+
+/* ============================================================================
+   Settings Grid
+   ============================================================================ */
+
+.admin-settings-grid {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 1.5rem;
+}
+
+.admin-settings-grid > .admin-card {
+  margin-bottom: 0;
+}
+
+@media (max-width: 900px) {
+  .admin-settings-grid {
+    grid-template-columns: 1fr;
+  }
+}

src/admin/offers.css

@@ -2,63 +2,6 @@
    Offers Module
    ============================================ */
 
-/* Editor section cards */
-.offers-editor-section {
-  background: var(--glass-bg);
-  backdrop-filter: blur(12px);
-  -webkit-backdrop-filter: blur(12px);
-  border: 1px solid var(--glass-border);
-  box-shadow: var(--glass-shadow);
-  border-radius: 0.75rem;
-  padding: 1.5rem;
-  margin-bottom: 1.5rem;
-}
-
-/* Settings grid */
-.offers-settings-grid {
-  display: grid;
-  grid-template-columns: 1fr 1fr;
-  gap: 1.5rem;
-}
-
-.offers-settings-grid > .admin-card {
-  margin-bottom: 0;
-}
-
-@media (max-width: 900px) {
-  .offers-settings-grid {
-    grid-template-columns: 1fr;
-  }
-}
-
-/* Logo section */
-.offers-logo-section {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  gap: 1rem;
-  padding: 1rem;
-}
-
-.offers-logo-preview {
-  max-width: 200px;
-  max-height: 100px;
-  border: 1px solid var(--border-color);
-  border-radius: 0.5rem;
-  overflow: hidden;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  padding: 0.5rem;
-  background: #fff;
-}
-
-.offers-logo-preview img {
-  max-width: 100%;
-  max-height: 80px;
-  object-fit: contain;
-}
-
 /* Items table */
 .offers-items-table {
   overflow-x: auto;
@@ -103,213 +46,6 @@
   min-height: 32px;
 }
 
-/* Totals summary */
-.offers-totals-summary {
-  display: flex;
-  flex-direction: column;
-  align-items: flex-end;
-  gap: 0.25rem;
-  padding-top: 0.75rem;
-  border-top: 1px solid var(--border-color);
-}
-
-.offers-totals-row {
-  display: flex;
-  gap: 2rem;
-  justify-content: flex-end;
-  min-width: 250px;
-  padding: 0.25rem 0;
-  font-size: 0.875rem;
-  color: var(--text-secondary);
-}
-
-.offers-totals-row span:last-child {
-  min-width: 100px;
-  text-align: right;
-  font-weight: 500;
-  color: var(--text-primary);
-}
-
-.offers-totals-total {
-  border-top: 2px solid var(--text-primary);
-  margin-top: 0.25rem;
-  padding-top: 0.5rem;
-  font-size: 1rem;
-  font-weight: 600;
-}
-
-.offers-totals-total span:last-child {
-  font-weight: 700;
-}
-
-/* Scope sections list wrapper */
-.offers-scope-list {
-  margin-top: 1.25rem;
-  display: flex;
-  flex-direction: column;
-  gap: 1rem;
-}
-
-/* Scope section card */
-.offers-scope-section {
-  border: 1px solid var(--border-color);
-  border-radius: 0.5rem;
-  overflow: visible;
-  transition: border-color var(--transition);
-  background: var(--bg-primary);
-}
-
-.offers-scope-content {
-  overflow: hidden;
-}
-
-.offers-scope-section:hover {
-  border-color: color-mix(
-    in srgb,
-    var(--border-color) 70%,
-    var(--accent-color)
-  );
-}
-
-.offers-scope-section-header {
-  display: flex;
-  align-items: center;
-  padding: 0.625rem 1rem;
-  background: var(--bg-tertiary);
-  border-bottom: 1px solid var(--border-color);
-  border-radius: 0.5rem 0.5rem 0 0;
-  gap: 0.5rem;
-}
-
-.offers-scope-section-header .offers-scope-number {
-  font-size: 0.75rem;
-  font-weight: 600;
-  color: var(--text-tertiary);
-  flex-shrink: 0;
-  min-width: 1.25rem;
-}
-
-.offers-scope-section-header .offers-scope-title {
-  font-weight: 600;
-  font-size: 0.875rem;
-  color: var(--text-primary);
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  flex: 1;
-}
-
-.offers-scope-section-header .offers-scope-actions {
-  display: flex;
-  gap: 0.25rem;
-  margin-left: auto;
-  flex-shrink: 0;
-}
-
-.offers-scope-section .admin-form {
-  padding: 1rem;
-}
-
-/* Customer selector */
-.offers-customer-select {
-  position: relative;
-}
-
-.offers-customer-selected {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-  height: 36px;
-  padding: 0 12px;
-  border: 1px solid var(--border-color);
-  border-radius: var(--border-radius-sm);
-  background: var(--input-bg);
-  font-size: 13px;
-  font-weight: 500;
-  color: var(--text-primary);
-}
-
-.offers-customer-selected span {
-  flex: 1;
-  min-width: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.offers-customer-selected .admin-btn-icon {
-  flex-shrink: 0;
-  width: 22px;
-  height: 22px;
-  margin-right: -4px;
-}
-
-.offers-customer-dropdown {
-  position: absolute;
-  top: 100%;
-  left: 0;
-  right: 0;
-  z-index: 100;
-  max-height: 260px;
-  overflow-y: auto;
-  overscroll-behavior: contain;
-  background: var(--bg-primary);
-  border: 1px solid var(--border-color);
-  border-top: none;
-  border-radius: 0 0 var(--border-radius-sm) var(--border-radius-sm);
-  box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);
-  padding: 4px 0;
-}
-
-.offers-customer-dropdown::-webkit-scrollbar {
-  width: 5px;
-}
-
-.offers-customer-dropdown::-webkit-scrollbar-track {
-  background: transparent;
-}
-
-.offers-customer-dropdown::-webkit-scrollbar-thumb {
-  background: var(--border-color);
-  border-radius: 99px;
-}
-
-.offers-customer-dropdown::-webkit-scrollbar-thumb:hover {
-  background: var(--text-muted);
-}
-
-.offers-customer-dropdown-item {
-  padding: 8px 12px;
-  cursor: pointer;
-  transition: background var(--transition);
-  border-radius: 4px;
-  margin: 0 4px;
-}
-
-.offers-customer-dropdown-item:hover {
-  background: var(--bg-secondary);
-}
-
-.offers-customer-dropdown-item div:first-child {
-  font-size: 13px;
-  font-weight: 500;
-  color: var(--text-primary);
-  line-height: 1.3;
-}
-
-.offers-customer-dropdown-item div:last-child {
-  font-size: 11.5px;
-  color: var(--text-tertiary);
-  margin-top: 1px;
-}
-
-.offers-customer-dropdown-empty {
-  padding: 0.75rem;
-  text-align: center;
-  color: var(--text-tertiary);
-  font-size: 0.8125rem;
-}
-
 /* Template dropdown menu */
 .offers-template-menu {
   position: absolute;
@@ -361,81 +97,20 @@
   color: var(--danger);
 }
 
-/* Compact form row for 3+ columns */
-.offers-form-row-3 {
-  display: grid;
-  grid-template-columns: 1fr 1fr 1fr;
-  gap: 1rem;
-}
-
-@media (max-width: 768px) {
-  .offers-form-row-3 {
-    grid-template-columns: 1fr;
-  }
-}
-
-/* Tabs - zachovany pro zpetnou kompatibilitu, nove pouzivat admin-tabs/admin-tab */
-.offers-tabs {
-  display: inline-flex;
-  gap: 4px;
-  padding: 4px;
-  background: var(--bg-tertiary);
-  border: 1px solid var(--border-color);
-  border-radius: 0.625rem;
-  margin-bottom: 1.5rem;
-  max-width: 100%;
-  overflow-x: auto;
-}
-
-.offers-tab {
-  position: relative;
-  display: inline-flex;
-  align-items: center;
-  gap: 0.5rem;
-  padding: 0.5rem 1.25rem;
-  background: transparent;
-  border: none;
-  border-radius: 0.5rem;
-  color: var(--text-muted);
-  font-size: 0.8125rem;
-  font-weight: 500;
-  font-family: inherit;
-  cursor: pointer;
-  transition:
-    color 0.2s ease,
-    background 0.2s ease,
-    box-shadow 0.2s ease;
-  letter-spacing: 0.01em;
-  white-space: nowrap;
-}
-
-.offers-tab:hover {
-  color: var(--text-primary);
-}
-
-.offers-tab.active {
-  color: var(--text-primary);
-  font-weight: 600;
-  background: var(--bg-secondary);
-  box-shadow:
-    0 1px 3px rgba(0, 0, 0, 0.12),
-    0 0 0 1px var(--border-color);
-}
-
 /* RichEditor (Quill) */
-.rich-editor {
+.admin-rich-editor {
   border: 1px solid var(--border-color);
   border-radius: 0.5rem;
   overflow: visible;
 }
 
-.rich-editor .quill {
+.admin-rich-editor .quill {
   display: flex;
   flex-direction: column;
 }
 
 /* Toolbar */
-.rich-editor .ql-toolbar.ql-snow {
+.admin-rich-editor .ql-toolbar.ql-snow {
   background: var(--bg-secondary);
   border: none;
   border-bottom: 1px solid var(--border-color);
@@ -445,60 +120,60 @@
   gap: 2px;
 }
 
-.rich-editor .ql-toolbar .ql-formats {
+.admin-rich-editor .ql-toolbar .ql-formats {
   margin-right: 8px;
 }
 
 /* Toolbar buttons */
-.rich-editor .ql-snow .ql-stroke {
+.admin-rich-editor .ql-snow .ql-stroke {
   stroke: var(--text-secondary);
 }
-.rich-editor .ql-snow .ql-fill {
+.admin-rich-editor .ql-snow .ql-fill {
   fill: var(--text-secondary);
 }
-.rich-editor .ql-snow .ql-picker-label {
+.admin-rich-editor .ql-snow .ql-picker-label {
   color: var(--text-secondary);
   border-color: var(--border-color);
 }
 
-.rich-editor .ql-snow button:hover .ql-stroke,
-.rich-editor .ql-snow .ql-picker-label:hover .ql-stroke {
+.admin-rich-editor .ql-snow button:hover .ql-stroke,
+.admin-rich-editor .ql-snow .ql-picker-label:hover .ql-stroke {
   stroke: var(--text-primary);
 }
-.rich-editor .ql-snow button:hover .ql-fill,
-.rich-editor .ql-snow .ql-picker-label:hover .ql-fill {
+.admin-rich-editor .ql-snow button:hover .ql-fill,
+.admin-rich-editor .ql-snow .ql-picker-label:hover .ql-fill {
   fill: var(--text-primary);
 }
-.rich-editor .ql-snow button:hover,
-.rich-editor .ql-snow .ql-picker-label:hover {
+.admin-rich-editor .ql-snow button:hover,
+.admin-rich-editor .ql-snow .ql-picker-label:hover {
   color: var(--text-primary);
 }
 
 /* Active state */
-.rich-editor .ql-snow button.ql-active {
+.admin-rich-editor .ql-snow button.ql-active {
   color: var(--accent-color);
   background: color-mix(in srgb, var(--accent-color) 15%, transparent);
   border-radius: 4px;
 }
-.rich-editor .ql-snow button.ql-active .ql-stroke {
+.admin-rich-editor .ql-snow button.ql-active .ql-stroke {
   stroke: var(--accent-color);
 }
-.rich-editor .ql-snow button.ql-active .ql-fill,
-.rich-editor .ql-snow button.ql-active .ql-stroke.ql-fill {
+.admin-rich-editor .ql-snow button.ql-active .ql-fill,
+.admin-rich-editor .ql-snow button.ql-active .ql-stroke.ql-fill {
   fill: var(--accent-color);
 }
-.rich-editor .ql-snow .ql-picker-item.ql-selected {
+.admin-rich-editor .ql-snow .ql-picker-item.ql-selected {
   color: var(--accent-color);
 }
-.rich-editor .ql-snow .ql-picker-label.ql-active {
+.admin-rich-editor .ql-snow .ql-picker-label.ql-active {
   color: var(--accent-color);
 }
-.rich-editor .ql-snow .ql-picker-label.ql-active .ql-stroke {
+.admin-rich-editor .ql-snow .ql-picker-label.ql-active .ql-stroke {
   stroke: var(--accent-color);
 }
 
 /* Dropdowns (font, size, color, align) */
-.rich-editor .ql-snow .ql-picker-options {
+.admin-rich-editor .ql-snow .ql-picker-options {
   background: var(--bg-primary);
   border: 1px solid var(--border-color);
   border-radius: 0.375rem;
@@ -507,23 +182,23 @@
   padding: 0.25rem;
 }
 
-.rich-editor .ql-snow .ql-picker-item {
+.admin-rich-editor .ql-snow .ql-picker-item {
   color: var(--text-secondary);
   padding: 0.25rem 0.5rem;
   border-radius: 0.25rem;
 }
-.rich-editor .ql-snow .ql-picker-item:hover {
+.admin-rich-editor .ql-snow .ql-picker-item:hover {
   color: var(--text-primary);
   background: var(--bg-secondary);
 }
 
 /* Font picker */
-.rich-editor .ql-snow .ql-font .ql-picker-options {
+.admin-rich-editor .ql-snow .ql-font .ql-picker-options {
   min-width: 11rem;
   max-height: 200px;
   overflow-y: auto;
 }
-.rich-editor .ql-snow .ql-size .ql-picker-options {
+.admin-rich-editor .ql-snow .ql-size .ql-picker-options {
   max-height: 200px;
   overflow-y: auto;
 }
@@ -703,34 +378,39 @@
 }
 
 /* Editor area */
-.rich-editor .ql-container.ql-snow {
+.admin-rich-editor .ql-container.ql-snow {
   border: none;
   border-radius: 0 0 0.5rem 0.5rem;
-  font-size: 0.875rem;
+  font-family: Tahoma, sans-serif;
+  font-size: 14px;
 }
 
-.rich-editor .ql-editor {
+.admin-rich-editor .ql-editor {
   min-height: var(--re-min-height, 120px);
   padding: 0.75rem;
   color: var(--text-primary);
   line-height: 1.6;
-  font-size: 0.875rem;
+  font-family: Tahoma, sans-serif;
+  font-size: 14px;
   background: var(--input-bg);
 }
 
-.rich-editor .ql-editor.ql-blank::before {
+.admin-rich-editor .ql-editor.ql-blank::before {
   color: var(--text-tertiary);
   font-style: normal;
 }
 
 /* Lists inside editor */
-.rich-editor .ql-editor ul,
-.rich-editor .ql-editor ol {
+.admin-rich-editor .ql-editor ul,
+.admin-rich-editor .ql-editor ol {
   padding-left: 1.5rem;
 }
 
 /* Color picker */
-.rich-editor .ql-snow .ql-color-picker .ql-picker-options[aria-hidden="false"] {
+.admin-rich-editor
+  .ql-snow
+  .ql-color-picker
+  .ql-picker-options[aria-hidden="false"] {
   width: 176px;
   padding: 0.375rem;
   display: flex;
@@ -738,7 +418,7 @@
   gap: 2px;
 }
 
-.rich-editor .ql-snow .ql-color-picker .ql-picker-item {
+.admin-rich-editor .ql-snow .ql-color-picker .ql-picker-item {
   width: 18px;
   height: 18px;
   border-radius: 2px;
@@ -748,7 +428,7 @@
 }
 
 /* Tooltip (link editor) */
-.rich-editor .ql-snow .ql-tooltip {
+.admin-rich-editor .ql-snow .ql-tooltip {
   background: var(--bg-primary);
   border: 1px solid var(--border-color);
   border-radius: 0.375rem;
@@ -756,7 +436,7 @@
   color: var(--text-primary);
 }
 
-.rich-editor .ql-snow .ql-tooltip input[type="text"] {
+.admin-rich-editor .ql-snow .ql-tooltip input[type="text"] {
   background: var(--bg-secondary);
   border: 1px solid var(--border-color);
   border-radius: 0.25rem;
@@ -764,12 +444,12 @@
   padding: 0.25rem 0.5rem;
 }
 
-.rich-editor .ql-snow .ql-tooltip a {
+.admin-rich-editor .ql-snow .ql-tooltip a {
   color: var(--accent-color);
 }
 
 /* Read-only rendered rich text (Quill HTML output) */
-.rich-text-view {
+.admin-rich-text-view {
   color: var(--text-secondary);
   line-height: 1.6;
   font-size: 0.875rem;
@@ -778,56 +458,44 @@
   min-width: 0;
 }
 
-.rich-text-view ul,
-.rich-text-view ol {
+.admin-rich-text-view ul,
+.admin-rich-text-view ol {
   padding-left: 1.5rem;
   margin: 0.25rem 0 0.75rem;
 }
 
-.rich-text-view li {
+.admin-rich-text-view li {
   margin-bottom: 0.15rem;
 }
 
-.rich-text-view a {
+.admin-rich-text-view a {
   color: var(--accent-color);
 }
 
-.rich-text-view strong,
-.rich-text-view b {
+.admin-rich-text-view strong,
+.admin-rich-text-view b {
   font-weight: 600;
   color: var(--text-primary);
   display: inline-block;
   margin-top: 0.5rem;
 }
 
-.rich-text-view br + b,
-.rich-text-view br + strong {
+.admin-rich-text-view br + b,
+.admin-rich-text-view br + strong {
   margin-top: 0.75rem;
 }
 
-.rich-text-view > br:first-child,
-.rich-text-view ul + br,
-.rich-text-view ol + br {
+.admin-rich-text-view > br:first-child,
+.admin-rich-text-view ul + br,
+.admin-rich-text-view ol + br {
   display: none;
 }
 
 @media (max-width: 640px) {
-  .offers-editor-section {
-    padding: 1rem;
-  }
-
   .offers-items-table {
     margin: 0 -1rem;
     width: calc(100% + 2rem);
   }
-
-  .offers-totals-summary {
-    align-items: stretch;
-  }
-
-  .offers-totals-row {
-    min-width: unset;
-  }
 }
 
 /* Offer draft row in table */

src/admin/pages/Attendance.tsx

@@ -576,10 +576,7 @@ export default function Attendance() {
                     <div className="attendance-project-header">
                       <span className="attendance-shift-label">Projekt</span>
                       {activeProjectId ? (
-                        <span
-                          className="admin-badge admin-badge-wrap"
-                          style={{ fontSize: "0.8125rem" }}
-                        >
+                        <span className="admin-badge admin-badge-wrap text-sm">
                           {projects.find(
                             (p) => String(p.id) === String(activeProjectId),
                           )
@@ -587,12 +584,7 @@ export default function Attendance() {
                             : `Projekt #${activeProjectId}`}
                         </span>
                       ) : (
-                        <span
-                          className="text-muted"
-                          style={{ fontSize: "0.8125rem" }}
-                        >
-                          Žádný
-                        </span>
+                        <span className="text-muted text-sm">Žádný</span>
                       )}
                     </div>
                     <select
@@ -601,8 +593,7 @@ export default function Attendance() {
                         handleSwitchProject(e.target.value || null)
                       }
                       disabled={switchingProject}
-                      className="admin-form-select"
-                      style={{ fontSize: "0.875rem" }}
+                      className="admin-form-select text-md"
                     >
                       <option value="">— Bez projektu —</option>
                       {projects.map((p) => (
@@ -618,8 +609,11 @@ export default function Attendance() {
                           const end = log.ended_at
                             ? new Date(log.ended_at)
                             : new Date();
-                          const mins = Math.floor(
-                            (end.getTime() - start.getTime()) / 60000,
+                          const mins = Math.max(
+                            0,
+                            Math.floor(
+                              (end.getTime() - start.getTime()) / 60000,
+                            ),
                           );
                           const h = Math.floor(mins / 60);
                           const mm = mins % 60;
@@ -654,8 +648,7 @@ export default function Attendance() {
                     <button
                       onClick={handleBreak}
                       disabled={submitting}
-                      className="admin-btn admin-btn-secondary"
-                      style={{ width: "100%" }}
+                      className="admin-btn admin-btn-secondary w-full"
                     >
                       Pauza (30 min)
                     </button>
@@ -663,15 +656,13 @@ export default function Attendance() {
                   <button
                     onClick={() => handlePunch("departure")}
                     disabled={submitting}
-                    className="admin-btn admin-btn-primary"
-                    style={{ width: "100%" }}
+                    className="admin-btn admin-btn-primary w-full"
                   >
                     {submitting ? "Zpracovávám..." : "Odchod"}
                   </button>
                   <button
                     onClick={() => setShowLeaveModal(true)}
-                    className="admin-btn admin-btn-secondary"
-                    style={{ width: "100%" }}
+                    className="admin-btn admin-btn-secondary w-full"
                   >
                     Žádost o nepřítomnost
                   </button>
@@ -703,16 +694,14 @@ export default function Attendance() {
                 <button
                   onClick={() => handlePunch("arrival")}
                   disabled={submitting}
-                  className="admin-btn admin-btn-primary"
-                  style={{ width: "100%" }}
+                  className="admin-btn admin-btn-primary w-full"
                 >
                   {submitting ? "Zpracovávám..." : "Příchod"}
                 </button>
 
                 <button
                   onClick={() => setShowLeaveModal(true)}
-                  className="admin-btn admin-btn-secondary"
-                  style={{ width: "100%" }}
+                  className="admin-btn admin-btn-secondary w-full"
                 >
                   Žádost o nepřítomnost
                 </button>
@@ -877,11 +866,10 @@ export default function Attendance() {
               </div>
               <div style={{ marginTop: "0.75rem" }}>
                 <div
-                  className="text-secondary"
+                  className="text-secondary text-sm"
                   style={{
                     display: "flex",
                     justifyContent: "space-between",
-                    fontSize: "0.8125rem",
                     marginBottom: "0.5rem",
                   }}
                 >
@@ -905,8 +893,8 @@ export default function Attendance() {
                 </div>
                 {data.monthly_fund.leave_hours > 0 && (
                   <div
-                    className="text-muted"
-                    style={{ fontSize: "0.75rem", marginTop: "0.375rem" }}
+                    className="text-muted text-xs"
+                    style={{ marginTop: "0.375rem" }}
                   >
                     {"Pokryto: "}
                     {data.monthly_fund.covered}h (práce{" "}

src/admin/pages/AttendanceHistory.tsx

@@ -85,8 +85,11 @@ const renderProjectCell = (record: AttendanceRecord) => {
           } else {
             isActive = !log.ended_at;
             const end = log.ended_at ? new Date(log.ended_at) : new Date();
-            const mins = Math.floor(
-              (end.getTime() - new Date(log.started_at!).getTime()) / 60000,
+            const mins = Math.max(
+              0,
+              Math.floor(
+                (end.getTime() - new Date(log.started_at!).getTime()) / 60000,
+              ),
             );
             h = Math.floor(mins / 60);
             m = mins % 60;
@@ -126,6 +129,7 @@ export default function AttendanceHistory() {
   const alert = useAlert();
   const { user, hasPermission } = useAuth();
   const [loading, setLoading] = useState(true);
+  const [companyName, setCompanyName] = useState("");
   const printRef = useRef<HTMLDivElement>(null);
   const [month, setMonth] = useState(() => {
     const now = new Date();
@@ -156,6 +160,15 @@ export default function AttendanceHistory() {
     fetchData();
   }, [fetchData]);
 
+  useEffect(() => {
+    apiFetch(`${API_BASE}/company-settings`)
+      .then((r) => r.json())
+      .then((d) => {
+        if (d.success) setCompanyName(d.data.company_name || "");
+      })
+      .catch(() => {});
+  }, []);
+
   const computed = useMemo(() => {
     const [yearStr, monthStr] = month.split("-");
     const monthIndex = parseInt(monthStr, 10) - 1;
@@ -637,13 +650,13 @@ export default function AttendanceHistory() {
                   <div className="print-header">
                     <div className="print-header-left">
                       <img
-                        src="/images/logo-light.png"
-                        alt="BOHA"
+                        src="/api/admin/company-settings/logo?variant=light"
+                        alt=""
                         className="print-logo"
                       />
                       <div className="print-header-text">
                         <h1>EVIDENCE DOCHÁZKY</h1>
-                        <div className="company">BOHA Automation s.r.o.</div>
+                        <div className="company">{companyName}</div>
                       </div>
                     </div>
                     <div className="print-header-right">

src/admin/pages/AttendanceLocation.tsx

@@ -5,12 +5,13 @@ import Forbidden from "../components/Forbidden";
 import { useNavigate, useParams, Link } from "react-router-dom";
 import { motion } from "framer-motion";
 
+import L from "leaflet";
+import "leaflet/dist/leaflet.css";
+
 import { formatDate, formatTime } from "../utils/attendanceHelpers";
 import apiFetch from "../utils/api";
 const API_BASE = "/api/admin";
 
-declare const L: any;
-
 interface LocationRecord {
   user_name: string;
   shift_date: string;
@@ -74,23 +75,6 @@ export default function AttendanceLocation() {
 
     if (!hasAnyLocation || !mapRef.current) return;
 
-    const loadLeaflet = async () => {
-      if ((window as unknown as Record<string, unknown>).L) {
-        initMap();
-        return;
-      }
-
-      const link = document.createElement("link");
-      link.rel = "stylesheet";
-      link.href = "https://unpkg.com/leaflet@1.9.4/dist/leaflet.css";
-      document.head.appendChild(link);
-
-      const script = document.createElement("script");
-      script.src = "https://unpkg.com/leaflet@1.9.4/dist/leaflet.js";
-      script.onload = initMap;
-      document.body.appendChild(script);
-    };
-
     const initMap = () => {
       if (mapInstanceRef.current) {
         (mapInstanceRef.current as { remove: () => void }).remove();
@@ -175,7 +159,7 @@ export default function AttendanceLocation() {
       }
     };
 
-    loadLeaflet();
+    initMap();
 
     return () => {
       if (mapInstanceRef.current) {

src/admin/pages/CompanySettings.tsx

@@ -24,8 +24,6 @@ const FIELD_LABELS: Record<string, string> = {
   vat_id: "DIČ",
 };
 
-const currentYear = new Date().getFullYear().toString().slice(-2);
-
 interface CustomField {
   name: string;
   value: string;
@@ -41,11 +39,6 @@ interface CompanyForm {
   country: string;
   company_id: string;
   vat_id: string;
-  quotation_prefix: string;
-  default_currency: string;
-  default_vat_rate: number;
-  order_type_code: string;
-  invoice_type_code: string;
 }
 
 interface BankAccount {
@@ -69,14 +62,19 @@ interface BankForm {
   is_default: boolean;
 }
 
-export default function CompanySettings() {
+export default function CompanySettings({
+  embedded,
+}: { embedded?: boolean } = {}) {
   const alert = useAlert();
   const { hasPermission } = useAuth();
   const [loading, setLoading] = useState(true);
   const [saving, setSaving] = useState(false);
   const [uploadingLogo, setUploadingLogo] = useState(false);
+  const [uploadingLogoDark, setUploadingLogoDark] = useState(false);
   const [logoUrl, setLogoUrl] = useState<string | null>(null);
+  const [logoUrlDark, setLogoUrlDark] = useState<string | null>(null);
   const logoUrlRef = useRef<string | null>(null);
+  const logoUrlDarkRef = useRef<string | null>(null);
   const [form, setForm] = useState<CompanyForm>({
     company_name: "",
     street: "",
@@ -85,11 +83,6 @@ export default function CompanySettings() {
     country: "",
     company_id: "",
     vat_id: "",
-    quotation_prefix: "N",
-    default_currency: "EUR",
-    default_vat_rate: 21,
-    order_type_code: "71",
-    invoice_type_code: "81",
   });
   const [customFields, setCustomFields] = useState<CustomField[]>([]);
   const customFieldKeyCounter = useRef(0);
@@ -97,6 +90,12 @@ export default function CompanySettings() {
     ...DEFAULT_FIELD_ORDER,
   ]);
   const [bankAccounts, setBankAccounts] = useState<BankAccount[]>([]);
+  const [availableCurrencies, setAvailableCurrencies] = useState<string[]>([
+    "CZK",
+    "EUR",
+    "USD",
+    "GBP",
+  ]);
   const [bankLoading, setBankLoading] = useState(true);
   const [bankSaving, setBankSaving] = useState(false);
   const [editingBank, setEditingBank] = useState<number | null>(null);
@@ -151,17 +150,28 @@ export default function CompanySettings() {
     return key;
   };
 
-  const fetchLogo = useCallback(async () => {
+  const fetchLogo = useCallback(async (variant: "light" | "dark" = "light") => {
     try {
-      const resp = await apiFetch(`${API_BASE}/company-settings/logo`);
+      const resp = await apiFetch(
+        `${API_BASE}/company-settings/logo?variant=${variant}`,
+      );
       if (resp.ok) {
         const blob = await resp.blob();
-        setLogoUrl((prev) => {
-          if (prev) URL.revokeObjectURL(prev);
-          const url = URL.createObjectURL(blob);
-          logoUrlRef.current = url;
-          return url;
-        });
+        if (variant === "dark") {
+          setLogoUrlDark((prev) => {
+            if (prev) URL.revokeObjectURL(prev);
+            const url = URL.createObjectURL(blob);
+            logoUrlDarkRef.current = url;
+            return url;
+          });
+        } else {
+          setLogoUrl((prev) => {
+            if (prev) URL.revokeObjectURL(prev);
+            const url = URL.createObjectURL(blob);
+            logoUrlRef.current = url;
+            return url;
+          });
+        }
       }
     } catch {
       // ignore - no logo
@@ -183,11 +193,6 @@ export default function CompanySettings() {
           country: d.country || "",
           company_id: d.company_id || "",
           vat_id: d.vat_id || "",
-          quotation_prefix: d.quotation_prefix || "N",
-          default_currency: d.default_currency || "EUR",
-          default_vat_rate: d.default_vat_rate || 21,
-          order_type_code: d.order_type_code || "71",
-          invoice_type_code: d.invoice_type_code || "81",
         });
         const cf =
           Array.isArray(d.custom_fields) && d.custom_fields.length > 0
@@ -207,8 +212,17 @@ export default function CompanySettings() {
         } else {
           setFieldOrder([...DEFAULT_FIELD_ORDER]);
         }
+        if (
+          Array.isArray(d.available_currencies) &&
+          d.available_currencies.length > 0
+        ) {
+          setAvailableCurrencies(d.available_currencies);
+        }
         if (d.has_logo) {
-          fetchLogo();
+          fetchLogo("light");
+        }
+        if (d.has_logo_dark) {
+          fetchLogo("dark");
         }
       } else {
         alert.error(result.error || "Nepodařilo se načíst nastavení");
@@ -316,10 +330,11 @@ export default function CompanySettings() {
     fetchBankAccounts();
   }, [fetchData, fetchBankAccounts]);
 
-  // Cleanup blob URL on unmount
+  // Cleanup blob URLs on unmount
   useEffect(() => {
     return () => {
       if (logoUrlRef.current) URL.revokeObjectURL(logoUrlRef.current);
+      if (logoUrlDarkRef.current) URL.revokeObjectURL(logoUrlDarkRef.current);
     };
   }, []);
 
@@ -351,30 +366,38 @@ export default function CompanySettings() {
     }
   };
 
-  const handleLogoUpload = async (e: React.ChangeEvent<HTMLInputElement>) => {
+  const handleLogoUpload = async (
+    e: React.ChangeEvent<HTMLInputElement>,
+    variant: "light" | "dark" = "light",
+  ) => {
     const file = e.target.files?.[0];
     if (!file) return;
 
-    setUploadingLogo(true);
+    const setUploading =
+      variant === "dark" ? setUploadingLogoDark : setUploadingLogo;
+    setUploading(true);
     try {
       const formData = new FormData();
       formData.append("logo", file);
 
-      const response = await apiFetch(`${API_BASE}/company-settings/logo`, {
-        method: "POST",
-        body: formData,
-      });
+      const response = await apiFetch(
+        `${API_BASE}/company-settings/logo?variant=${variant}`,
+        {
+          method: "POST",
+          body: formData,
+        },
+      );
       const result = await response.json();
       if (result.success) {
         alert.success(result.message || "Logo bylo nahráno");
-        fetchLogo();
+        fetchLogo(variant);
       } else {
         alert.error(result.error || "Nepodařilo se nahrát logo");
       }
     } catch {
       alert.error("Chyba připojení");
     } finally {
-      setUploadingLogo(false);
+      setUploading(false);
       e.target.value = "";
     }
   };
@@ -383,7 +406,7 @@ export default function CompanySettings() {
     setForm((prev) => ({ ...prev, [field]: value }));
   };
 
-  if (!hasPermission("offers.settings")) return <Forbidden />;
+  if (!embedded && !hasPermission("settings.manage")) return <Forbidden />;
 
   if (loading) {
     return (
@@ -464,35 +487,35 @@ export default function CompanySettings() {
 
   return (
     <div>
-      <motion.div
-        className="admin-page-header"
-        initial={{ opacity: 0, y: 12 }}
-        animate={{ opacity: 1, y: 0 }}
-        transition={{ duration: 0.25 }}
-      >
-        <div>
-          <h1 className="admin-page-title">Nastavení firmy</h1>
-          <p className="admin-page-subtitle">
-            Firemní údaje, číslování dokladů a výchozí hodnoty
-          </p>
-        </div>
-        <button
-          onClick={handleSave}
-          className="admin-btn admin-btn-primary"
-          disabled={saving}
+      {!embedded && (
+        <motion.div
+          className="admin-page-header"
+          initial={{ opacity: 0, y: 12 }}
+          animate={{ opacity: 1, y: 0 }}
+          transition={{ duration: 0.25 }}
         >
-          {saving ? (
-            <>
-              <div className="admin-spinner admin-spinner-sm" />
-              Ukládání...
-            </>
-          ) : (
-            "Uložit nastavení"
-          )}
-        </button>
-      </motion.div>
+          <div>
+            <h1 className="admin-page-title">Nastavení firmy</h1>
+            <p className="admin-page-subtitle">Firemní údaje a bankovní účty</p>
+          </div>
+          <button
+            onClick={handleSave}
+            className="admin-btn admin-btn-primary"
+            disabled={saving}
+          >
+            {saving ? (
+              <>
+                <div className="admin-spinner admin-spinner-sm" />
+                Ukládání...
+              </>
+            ) : (
+              "Uložit nastavení"
+            )}
+          </button>
+        </motion.div>
+      )}
 
-      <div className="offers-settings-grid">
+      <div className="admin-settings-grid">
         {/* Company Info */}
         <motion.div
           className="admin-card"
@@ -898,10 +921,11 @@ export default function CompanySettings() {
                           }
                           className="admin-form-select"
                         >
-                          <option value="CZK">CZK</option>
-                          <option value="EUR">EUR</option>
-                          <option value="USD">USD</option>
-                          <option value="GBP">GBP</option>
+                          {availableCurrencies.map((c) => (
+                            <option key={c} value={c}>
+                              {c}
+                            </option>
+                          ))}
                         </select>
                       </FormField>
                     </div>
@@ -1055,177 +1079,135 @@ export default function CompanySettings() {
             <h3 className="admin-card-title">Logo</h3>
           </div>
           <div className="admin-card-body">
-            <div className="offers-logo-section">
-              {logoUrl && (
-                <div className="offers-logo-preview">
-                  <img src={logoUrl} alt="Logo" />
-                </div>
-              )}
-              <label
-                className="admin-btn admin-btn-secondary"
-                style={{ cursor: "pointer" }}
-              >
-                {uploadingLogo ? (
-                  <>
-                    <div className="admin-spinner admin-spinner-sm" />
-                    Nahrávání...
-                  </>
-                ) : (
-                  <>
-                    <svg
-                      width="16"
-                      height="16"
-                      viewBox="0 0 24 24"
-                      fill="none"
-                      stroke="currentColor"
-                      strokeWidth="2"
-                    >
-                      <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
-                      <polyline points="17 8 12 3 7 8" />
-                      <line x1="12" y1="3" x2="12" y2="15" />
-                    </svg>
-                    Nahrát logo
-                  </>
+            <div className="admin-form-row">
+              <div className="admin-logo-section">
+                <label
+                  className="admin-form-label"
+                  style={{ display: "block", marginBottom: 4 }}
+                >
+                  Logo (světlý režim)
+                </label>
+                {logoUrl && (
+                  <div className="admin-logo-preview">
+                    <img src={logoUrl} alt="Logo (světlý režim)" />
+                  </div>
                 )}
-                <input
-                  type="file"
-                  accept="image/*"
-                  onChange={handleLogoUpload}
-                  style={{ display: "none" }}
-                  disabled={uploadingLogo}
-                />
-              </label>
-              <small className="admin-form-hint">
-                PNG, JPEG, GIF nebo WebP, max 5 MB
-              </small>
-            </div>
-          </div>
-        </motion.div>
-
-        {/* Cislovani dokladu */}
-        <motion.div
-          className="admin-card"
-          initial={{ opacity: 0, y: 12 }}
-          animate={{ opacity: 1, y: 0 }}
-          transition={{ duration: 0.25, delay: 0.15 }}
-        >
-          <div className="admin-card-header">
-            <h3 className="admin-card-title">Číslování dokladů</h3>
-          </div>
-          <div className="admin-card-body">
-            <div className="admin-form">
-              <FormField label="Nabídky — prefix">
-                <input
-                  type="text"
-                  value={form.quotation_prefix}
-                  onChange={(e) =>
-                    updateField("quotation_prefix", e.target.value)
-                  }
-                  className="admin-form-input"
-                  placeholder="N"
-                  style={{ maxWidth: 120 }}
-                />
-                <small className="admin-form-hint">
-                  Formát: ROK/PREFIX/ČÍSLO — ukázka: {new Date().getFullYear()}/
-                  {form.quotation_prefix || "N"}/001
-                </small>
-              </FormField>
-              <hr
-                style={{
-                  border: "none",
-                  borderTop: "1px solid var(--border-color)",
-                  margin: "0.75rem 0",
-                }}
-              />
-              <FormField label="Objednávky a projekty — typový kód">
-                <input
-                  type="text"
-                  value={form.order_type_code}
-                  onChange={(e) =>
-                    updateField("order_type_code", e.target.value)
-                  }
-                  className="admin-form-input"
-                  placeholder="71"
-                  style={{ maxWidth: 120 }}
-                />
-                <small className="admin-form-hint">
-                  Formát: RRKÓD#### — ukázka: {currentYear}
-                  {form.order_type_code || "71"}0001
-                </small>
-              </FormField>
-              <hr
-                style={{
-                  border: "none",
-                  borderTop: "1px solid var(--border-color)",
-                  margin: "0.75rem 0",
-                }}
-              />
-              <FormField label="Faktury — typový kód">
-                <input
-                  type="text"
-                  value={form.invoice_type_code}
-                  onChange={(e) =>
-                    updateField("invoice_type_code", e.target.value)
-                  }
-                  className="admin-form-input"
-                  placeholder="81"
-                  style={{ maxWidth: 120 }}
-                />
-                <small className="admin-form-hint">
-                  Formát: RRKÓD#### — ukázka: {currentYear}
-                  {form.invoice_type_code || "81"}0001
-                </small>
-              </FormField>
-            </div>
-          </div>
-        </motion.div>
-
-        {/* Default values */}
-        <motion.div
-          className="admin-card"
-          initial={{ opacity: 0, y: 12 }}
-          animate={{ opacity: 1, y: 0 }}
-          transition={{ duration: 0.25, delay: 0.15 }}
-        >
-          <div className="admin-card-header">
-            <h3 className="admin-card-title">Výchozí hodnoty</h3>
-          </div>
-          <div className="admin-card-body">
-            <div className="admin-form">
-              <div className="admin-form-row">
-                <FormField label="Výchozí měna">
-                  <select
-                    value={form.default_currency}
-                    onChange={(e) =>
-                      updateField("default_currency", e.target.value)
-                    }
-                    className="admin-form-select"
-                  >
-                    <option value="EUR">EUR</option>
-                    <option value="USD">USD</option>
-                    <option value="CZK">CZK</option>
-                    <option value="GBP">GBP</option>
-                  </select>
-                </FormField>
-                <FormField label="Výchozí sazba DPH (%)">
+                <label
+                  className="admin-btn admin-btn-secondary"
+                  style={{ cursor: "pointer" }}
+                >
+                  {uploadingLogo ? (
+                    <>
+                      <div className="admin-spinner admin-spinner-sm" />
+                      Nahrávání...
+                    </>
+                  ) : (
+                    <>
+                      <svg
+                        width="16"
+                        height="16"
+                        viewBox="0 0 24 24"
+                        fill="none"
+                        stroke="currentColor"
+                        strokeWidth="2"
+                      >
+                        <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
+                        <polyline points="17 8 12 3 7 8" />
+                        <line x1="12" y1="3" x2="12" y2="15" />
+                      </svg>
+                      Nahrát logo
+                    </>
+                  )}
                   <input
-                    type="number"
-                    value={form.default_vat_rate}
-                    onChange={(e) =>
-                      updateField(
-                        "default_vat_rate",
-                        parseFloat(e.target.value) || 0,
-                      )
-                    }
-                    className="admin-form-input"
-                    step="0.1"
+                    type="file"
+                    accept="image/*"
+                    onChange={(e) => handleLogoUpload(e, "light")}
+                    style={{ display: "none" }}
+                    disabled={uploadingLogo}
                   />
-                </FormField>
+                </label>
+                <small className="admin-form-hint">
+                  PNG, JPEG, GIF nebo WebP, max 5 MB
+                </small>
+              </div>
+              <div className="admin-logo-section">
+                <label
+                  className="admin-form-label"
+                  style={{ display: "block", marginBottom: 4 }}
+                >
+                  Logo (tmavý režim)
+                </label>
+                {logoUrlDark && (
+                  <div className="admin-logo-preview">
+                    <img src={logoUrlDark} alt="Logo (tmavý režim)" />
+                  </div>
+                )}
+                <label
+                  className="admin-btn admin-btn-secondary"
+                  style={{ cursor: "pointer" }}
+                >
+                  {uploadingLogoDark ? (
+                    <>
+                      <div className="admin-spinner admin-spinner-sm" />
+                      Nahrávání...
+                    </>
+                  ) : (
+                    <>
+                      <svg
+                        width="16"
+                        height="16"
+                        viewBox="0 0 24 24"
+                        fill="none"
+                        stroke="currentColor"
+                        strokeWidth="2"
+                      >
+                        <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
+                        <polyline points="17 8 12 3 7 8" />
+                        <line x1="12" y1="3" x2="12" y2="15" />
+                      </svg>
+                      Nahrát logo
+                    </>
+                  )}
+                  <input
+                    type="file"
+                    accept="image/*"
+                    onChange={(e) => handleLogoUpload(e, "dark")}
+                    style={{ display: "none" }}
+                    disabled={uploadingLogoDark}
+                  />
+                </label>
+                <small className="admin-form-hint">
+                  PNG, JPEG, GIF nebo WebP, max 5 MB
+                </small>
               </div>
             </div>
           </div>
         </motion.div>
       </div>
+
+      {embedded && (
+        <motion.div
+          initial={{ opacity: 0, y: 12 }}
+          animate={{ opacity: 1, y: 0 }}
+          transition={{ duration: 0.25, delay: 0.2 }}
+        >
+          <button
+            onClick={handleSave}
+            className="admin-btn admin-btn-primary"
+            style={{ width: "100%", marginTop: "1rem" }}
+            disabled={saving}
+          >
+            {saving ? (
+              <>
+                <div className="admin-spinner admin-spinner-sm" />
+                Ukládání...
+              </>
+            ) : (
+              "Uložit nastavení firmy"
+            )}
+          </button>
+        </motion.div>
+      )}
     </div>
   );
 }

src/admin/pages/Dashboard.tsx

@@ -338,7 +338,7 @@ export default function Dashboard() {
       {/* Skeleton loading */}
       {dashLoading && (
         <div className="admin-skeleton" style={{ padding: 0, gap: "1.25rem" }}>
-          <div className="dash-kpi-grid dash-kpi-4">
+          <div className="admin-kpi-grid admin-kpi-4">
             {[0, 1, 2, 3].map((i) => (
               <div
                 key={i}
@@ -493,7 +493,7 @@ export default function Dashboard() {
                     </span>
                   </div>
                   <div className="dash-stat-row">
-                    <span>Prošlé</span>
+                    <span>Zneplatněné</span>
                     <span className="admin-badge admin-badge-warning">
                       {dashData.offers.expired_count}
                     </span>

src/admin/pages/Invoices.tsx

@@ -8,7 +8,7 @@ import {
 } from "react";
 import { useAlert } from "../context/AlertContext";
 import { useAuth } from "../context/AuthContext";
-import { Link } from "react-router-dom";
+import { Link, useSearchParams } from "react-router-dom";
 import { motion, AnimatePresence } from "framer-motion";
 import ConfirmModal from "../components/ConfirmModal";
 import Forbidden from "../components/Forbidden";
@@ -56,7 +56,7 @@ function formatCzkWithDetail(
   if (!Array.isArray(amounts) || amounts.length === 0)
     return { value: "0 Kč", detail: null };
   const hasForeign = amounts.some((a) => a.currency !== "CZK");
-  if (hasForeign && totalCzk !== null && totalCzk !== undefined) {
+  if (hasForeign && totalCzk != null) {
     return {
       value: formatCurrency(totalCzk, "CZK"),
       detail: formatMultiCurrency(amounts),
@@ -119,7 +119,11 @@ export default function Invoices() {
   const alert = useAlert();
   const { hasPermission } = useAuth();
 
-  const [activeTab, setActiveTab] = useState("issued");
+  const [searchParams, setSearchParams] = useSearchParams();
+  const activeTab =
+    searchParams.get("tab") === "received" ? "received" : "issued";
+  const setActiveTab = (tab: string) =>
+    setSearchParams({ tab }, { replace: true });
   const [receivedUploadOpen, setReceivedUploadOpen] = useState(false);
   const { sort, order, handleSort, activeSort } =
     useTableSort("invoice_number");
@@ -190,7 +194,6 @@ export default function Invoices() {
   }>({ show: false, invoice: null });
   const [deleting, setDeleting] = useState(false);
   const [pdfLoading, setPdfLoading] = useState<number | null>(null);
-  const [langModal, setLangModal] = useState<Invoice | null>(null);
   const [draft, setDraft] = useState<DraftData | null>(() => {
     try {
       const raw = localStorage.getItem(DRAFT_KEY);
@@ -280,29 +283,25 @@ export default function Invoices() {
     }
   };
 
-  const handlePdf = async (inv: Invoice, lang = "cs") => {
+  const handlePdf = async (inv: Invoice) => {
     if (pdfLoading) return;
-    setLangModal(null);
+    const newWindow = window.open("", "_blank");
     setPdfLoading(inv.id);
     try {
-      const response = await apiFetch(
-        `${API_BASE}/invoices-pdf/${inv.id}?lang=${encodeURIComponent(lang)}`,
-      );
-      if (response.status === 401) return;
-      if (!response.ok) {
-        alert.error("Nepodařilo se vygenerovat PDF");
+      const response = await apiFetch(`${API_BASE}/invoices/${inv.id}/file`);
+      if (response.status === 401) {
+        newWindow?.close();
         return;
       }
-      const html = await response.text();
-      const w = window.open("", "_blank");
-      if (w) {
-        w.document.open();
-        w.document.write(html);
-        w.document.close();
-        w.onload = () => w.print();
-      } else {
-        alert.error("Prohlížeč zablokoval vyskakovací okno");
+      if (!response.ok) {
+        newWindow?.close();
+        alert.error("PDF soubor nenalezen — otevřete fakturu a uložte ji");
+        return;
       }
+      const blob = await response.blob();
+      const url = URL.createObjectURL(blob);
+      if (newWindow) newWindow.location.href = url;
+      setTimeout(() => URL.revokeObjectURL(url), 60000);
     } catch {
       alert.error("Chyba při generování PDF");
     } finally {
@@ -330,7 +329,7 @@ export default function Invoices() {
               style={{ width: "140px", borderRadius: "8px" }}
             />
           </div>
-          <div className="dash-kpi-grid dash-kpi-4">
+          <div className="admin-kpi-grid admin-kpi-4">
             {[0, 1, 2, 3].map((i) => (
               <div key={i} className="admin-stat-card">
                 <div
@@ -493,15 +492,15 @@ export default function Invoices() {
           </button>
         </div>
 
-        <div className="offers-tabs mb-4" style={{ justifyContent: "center" }}>
+        <div className="admin-tabs mb-4" style={{ justifyContent: "center" }}>
           <button
-            className={`offers-tab ${activeTab === "issued" ? "active" : ""}`}
+            className={`admin-tab ${activeTab === "issued" ? "active" : ""}`}
             onClick={() => setActiveTab("issued")}
           >
             Vydané
           </button>
           <button
-            className={`offers-tab ${activeTab === "received" ? "active" : ""}`}
+            className={`admin-tab ${activeTab === "received" ? "active" : ""}`}
             onClick={() => setActiveTab("received")}
           >
             Přijaté
@@ -518,7 +517,7 @@ export default function Invoices() {
           <Suspense
             fallback={
               <div
-                className="dash-kpi-grid dash-kpi-4"
+                className="admin-kpi-grid admin-kpi-4"
                 style={{ marginBottom: "1.5rem" }}
               >
                 {[0, 1, 2, 3].map((i) => (
@@ -565,7 +564,7 @@ export default function Invoices() {
           >
             {!hasLoadedOnce.current && statsLoading ? (
               <div
-                className="dash-kpi-grid dash-kpi-4"
+                className="admin-kpi-grid admin-kpi-4"
                 style={{ marginBottom: "1.5rem" }}
               >
                 {[0, 1, 2, 3].map((i) => (
@@ -603,7 +602,7 @@ export default function Invoices() {
                   >
                     <motion.div
                       key={slideKey}
-                      className="dash-kpi-grid dash-kpi-4"
+                      className="admin-kpi-grid admin-kpi-4"
                       custom={slideDirection.current}
                       variants={{
                         enter: (dir: number) => ({
@@ -736,11 +735,11 @@ export default function Invoices() {
             animate={{ opacity: 1, y: 0 }}
             transition={{ duration: 0.25, delay: 0.12 }}
           >
-            <div className="offers-tabs mb-6">
+            <div className="admin-tabs mb-6">
               {STATUS_FILTERS.map((f) => (
                 <button
                   key={f.value}
-                  className={`offers-tab ${statusFilter === f.value ? "active" : ""}`}
+                  className={`admin-tab ${statusFilter === f.value ? "active" : ""}`}
                   onClick={() => {
                     setStatusFilter(f.value);
                     setPage(1);
@@ -992,26 +991,44 @@ export default function Invoices() {
                                 <Link
                                   to={`/invoices/${inv.id}`}
                                   className="admin-btn-icon"
-                                  title="Detail"
-                                  aria-label="Detail"
+                                  title={
+                                    inv.status === "paid" ? "Detail" : "Upravit"
+                                  }
+                                  aria-label={
+                                    inv.status === "paid" ? "Detail" : "Upravit"
+                                  }
                                 >
-                                  <svg
-                                    width="18"
-                                    height="18"
-                                    viewBox="0 0 24 24"
-                                    fill="none"
-                                    stroke="currentColor"
-                                    strokeWidth="2"
-                                  >
-                                    <path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z" />
-                                    <circle cx="12" cy="12" r="3" />
-                                  </svg>
+                                  {inv.status === "paid" ? (
+                                    <svg
+                                      width="18"
+                                      height="18"
+                                      viewBox="0 0 24 24"
+                                      fill="none"
+                                      stroke="currentColor"
+                                      strokeWidth="2"
+                                    >
+                                      <path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z" />
+                                      <circle cx="12" cy="12" r="3" />
+                                    </svg>
+                                  ) : (
+                                    <svg
+                                      width="18"
+                                      height="18"
+                                      viewBox="0 0 24 24"
+                                      fill="none"
+                                      stroke="currentColor"
+                                      strokeWidth="2"
+                                    >
+                                      <path d="M11 4H4a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2v-7" />
+                                      <path d="M18.5 2.5a2.121 2.121 0 0 1 3 3L12 15l-4 1 1-4 9.5-9.5z" />
+                                    </svg>
+                                  )}
                                 </Link>
                                 {hasPermission("invoices.export") && (
                                   <button
-                                    onClick={() => setLangModal(inv)}
+                                    onClick={() => handlePdf(inv)}
                                     className="admin-btn-icon"
-                                    title="PDF"
+                                    title="Zobrazit fakturu"
                                     disabled={pdfLoading === inv.id}
                                   >
                                     {pdfLoading === inv.id ? (
@@ -1088,69 +1105,6 @@ export default function Invoices() {
             type="danger"
             loading={deleting}
           />
-
-          <AnimatePresence>
-            {langModal && (
-              <motion.div
-                className="admin-modal-overlay"
-                initial={{ opacity: 0 }}
-                animate={{ opacity: 1 }}
-                exit={{ opacity: 0 }}
-                transition={{ duration: 0.2 }}
-              >
-                <div
-                  className="admin-modal-backdrop"
-                  onClick={() => setLangModal(null)}
-                />
-                <motion.div
-                  className="admin-modal admin-confirm-modal"
-                  role="dialog"
-                  aria-modal="true"
-                  initial={{ opacity: 0, scale: 0.95, y: 20 }}
-                  animate={{ opacity: 1, scale: 1, y: 0 }}
-                  exit={{ opacity: 0, scale: 0.95, y: 20 }}
-                  transition={{ duration: 0.2 }}
-                >
-                  <div className="admin-modal-body admin-confirm-content">
-                    <div className="admin-confirm-icon admin-confirm-icon-info">
-                      <svg
-                        width="24"
-                        height="24"
-                        viewBox="0 0 24 24"
-                        fill="none"
-                        stroke="currentColor"
-                        strokeWidth="2"
-                      >
-                        <path d="M12 22c5.523 0 10-4.477 10-10S17.523 2 12 2 2 6.477 2 12s4.477 10 10 10z" />
-                        <path d="M2 12h20" />
-                        <path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z" />
-                      </svg>
-                    </div>
-                    <h2 className="admin-confirm-title">Jazyk faktury</h2>
-                    <p className="admin-confirm-message">
-                      V jakém jazyce chcete vygenerovat fakturu?
-                    </p>
-                  </div>
-                  <div className="admin-modal-footer">
-                    <button
-                      type="button"
-                      onClick={() => handlePdf(langModal, "cs")}
-                      className="admin-btn admin-btn-primary"
-                    >
-                      Čeština
-                    </button>
-                    <button
-                      type="button"
-                      onClick={() => handlePdf(langModal, "en")}
-                      className="admin-btn admin-btn-primary"
-                    >
-                      English
-                    </button>
-                  </div>
-                </motion.div>
-              </motion.div>
-            )}
-          </AnimatePresence>
         </>
       )}
     </div>

src/admin/pages/LeaveApproval.tsx

@@ -313,9 +313,9 @@ export default function LeaveApproval() {
         animate={{ opacity: 1, y: 0 }}
         transition={{ duration: 0.25, delay: 0.06 }}
       >
-        <div className="offers-tabs mb-6">
+        <div className="admin-tabs mb-6">
           <button
-            className={`offers-tab ${activeTab === "pending" ? "active" : ""}`}
+            className={`admin-tab ${activeTab === "pending" ? "active" : ""}`}
             onClick={() => setActiveTab("pending")}
           >
             Ke schválení
@@ -333,7 +333,7 @@ export default function LeaveApproval() {
             )}
           </button>
           <button
-            className={`offers-tab ${activeTab === "processed" ? "active" : ""}`}
+            className={`admin-tab ${activeTab === "processed" ? "active" : ""}`}
             onClick={() => setActiveTab("processed")}
           >
             Vyřízené

src/admin/pages/LeaveRequests.tsx

@@ -61,7 +61,7 @@ export default function LeaveRequests() {
 
   const fetchRequests = useCallback(async () => {
     try {
-      const response = await apiFetch(`${API_BASE}/leave-requests`);
+      const response = await apiFetch(`${API_BASE}/leave-requests?mine=1`);
       if (response.status === 401) return;
       const result = await response.json();
       if (result.success) {

src/admin/pages/Login.tsx

@@ -190,11 +190,17 @@ export default function Login() {
               <img
                 src={
                   theme === "dark"
-                    ? "/images/logo-dark.png"
-                    : "/images/logo-light.png"
+                    ? "/api/admin/company-settings/logo?variant=dark"
+                    : "/api/admin/company-settings/logo?variant=light"
                 }
                 alt="Logo"
                 className="admin-login-logo"
+                onError={(e) => {
+                  (e.target as HTMLImageElement).src =
+                    theme === "dark"
+                      ? "/images/logo-dark.png"
+                      : "/images/logo-light.png";
+                }}
               />
               <h1 className="admin-login-title">Interní systém</h1>
               <p className="admin-login-subtitle">Přihlaste se ke svému účtu</p>

src/admin/pages/OfferDetail.tsx

@@ -98,7 +98,7 @@ const emptyForm: OfferForm = {
   customer_name: "",
   created_at: new Date().toISOString().split("T")[0],
   valid_until: "",
-  currency: "EUR",
+  currency: "CZK",
   language: "EN",
   vat_rate: 21,
   apply_vat: false,
@@ -180,9 +180,7 @@ function SortableItemRow({
           </button>
         </td>
       )}
-      <td style={{ textAlign: "center", color: "var(--text-tertiary)" }}>
-        {index + 1}
-      </td>
+      <td className="text-center text-tertiary">{index + 1}</td>
       <td style={{ verticalAlign: "top" }}>
         <div
           style={{ display: "flex", flexDirection: "column", gap: "0.25rem" }}
@@ -191,10 +189,9 @@ function SortableItemRow({
             type="text"
             value={item.description}
             onChange={(e) => onUpdate("description", e.target.value)}
-            className="admin-form-input"
+            className="admin-form-input fw-500"
             placeholder="Název položky"
             readOnly={readOnly}
-            style={{ fontWeight: 500 }}
           />
           <input
             type="text"
@@ -240,7 +237,7 @@ function SortableItemRow({
           readOnly={readOnly}
         />
       </td>
-      <td style={{ textAlign: "center" }}>
+      <td className="text-center">
         <input
           type="checkbox"
           checked={item.is_included_in_total}
@@ -248,10 +245,7 @@ function SortableItemRow({
           disabled={readOnly}
         />
       </td>
-      <td
-        className="admin-mono"
-        style={{ textAlign: "right", fontWeight: 600 }}
-      >
+      <td className="admin-mono text-right fw-600">
         {formatCurrency(lineTotal, currency)}
       </td>
       {!readOnly && (
@@ -327,6 +321,12 @@ export default function OfferDetail() {
   const [customerOrderNumber, setCustomerOrderNumber] = useState("");
   const [orderAttachment, setOrderAttachment] = useState<File | null>(null);
   const [pdfLoading, setPdfLoading] = useState(false);
+  const [companySettings, setCompanySettings] = useState<{
+    default_currency: string;
+    default_vat_rate: number;
+    available_currencies: string[];
+    available_vat_rates: number[];
+  } | null>(null);
   const [lockedBy, setLockedBy] = useState<{
     user_id: number;
     username: string;
@@ -336,6 +336,31 @@ export default function OfferDetail() {
 
   useModalLock(showOrderModal);
 
+  useEffect(() => {
+    apiFetch(`${API_BASE}/company-settings`)
+      .then((r) => r.json())
+      .then((d) => {
+        if (d.success) setCompanySettings(d.data);
+      })
+      .catch(() => {});
+  }, []);
+
+  useEffect(() => {
+    if (companySettings && !isEdit) {
+      setForm((prev) => ({
+        ...prev,
+        currency:
+          prev.currency === "CZK"
+            ? companySettings.default_currency || "CZK"
+            : prev.currency,
+        vat_rate:
+          prev.vat_rate === 21
+            ? (companySettings.default_vat_rate ?? 21)
+            : prev.vat_rate,
+      }));
+    }
+  }, [companySettings, isEdit]);
+
   const isInvalidated = offerStatus === "invalidated";
   const isLockedByOther = !!lockedBy;
   const isExpiredNotInvalidated =
@@ -362,9 +387,9 @@ export default function OfferDetail() {
           valid_until: d.valid_until
             ? String(d.valid_until).substring(0, 10)
             : "",
-          currency: d.currency || "EUR",
+          currency: d.currency || companySettings?.default_currency || "CZK",
           language: d.language || "EN",
-          vat_rate: d.vat_rate ?? 21,
+          vat_rate: d.vat_rate ?? companySettings?.default_vat_rate ?? 21,
           apply_vat: !!d.apply_vat,
           exchange_rate: d.exchange_rate || "",
           scope_title: d.scope_title || "",
@@ -408,7 +433,7 @@ export default function OfferDetail() {
     } finally {
       setLoading(false);
     }
-  }, [id, alert, navigate, hasPermission]);
+  }, [id, alert, navigate, hasPermission, companySettings]);
 
   // Heartbeat to keep lock alive + cleanup on unmount
   useEffect(() => {
@@ -610,14 +635,17 @@ export default function OfferDetail() {
     setSaving(true);
     try {
       const url = isEdit ? `${API_BASE}/offers/${id}` : `${API_BASE}/offers`;
+      const payload: any = {
+        ...form,
+        items: items.map((item, i) => ({ ...item, position: i })),
+        sections: sections.map((s, i) => ({ ...s, position: i })),
+      };
+      if (!isEdit) delete payload.quotation_number;
+
       const response = await apiFetch(url, {
         method: isEdit ? "PUT" : "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          ...form,
-          items: items.map((item, i) => ({ ...item, position: i })),
-          sections: sections.map((s, i) => ({ ...s, position: i })),
-        }),
+        body: JSON.stringify(payload),
       });
       const result = await response.json();
       if (result.success) {
@@ -737,19 +765,25 @@ export default function OfferDetail() {
 
   const handlePdf = async () => {
     if (!isEdit || pdfLoading) return;
+    const newWindow = window.open("", "_blank");
     setPdfLoading(true);
     try {
       const response = await apiFetch(`${API_BASE}/offers/${id}/file`);
-      if (response.status === 401) return;
+      if (response.status === 401) {
+        newWindow?.close();
+        return;
+      }
       if (!response.ok) {
+        newWindow?.close();
         alert.error("PDF soubor nenalezen — uložte nabídku pro vygenerování");
         return;
       }
       const blob = await response.blob();
       const url = URL.createObjectURL(blob);
-      window.open(url, "_blank");
+      if (newWindow) newWindow.location.href = url;
       setTimeout(() => URL.revokeObjectURL(url), 60000);
     } catch {
+      newWindow?.close();
       alert.error("Chyba při generování PDF");
     } finally {
       setPdfLoading(false);
@@ -837,11 +871,10 @@ export default function OfferDetail() {
               {isEdit ? `Nabídka ${form.quotation_number}` : "Nová nabídka"}
               {isInvalidated && (
                 <span
-                  className="admin-badge admin-badge-danger"
+                  className="admin-badge admin-badge-danger text-xs"
                   style={{
                     marginLeft: "0.75rem",
                     verticalAlign: "middle",
-                    fontSize: "0.75rem",
                   }}
                 >
                   Zneplatněna
@@ -974,25 +1007,24 @@ export default function OfferDetail() {
 
       {/* Quotation Form */}
       <motion.div
-        className={`offers-editor-section${isInvalidated || isLockedByOther ? " offers-readonly" : ""}`}
+        className={`admin-editor-section${isInvalidated || isLockedByOther ? " offers-readonly" : ""}`}
         initial={{ opacity: 0, y: 12 }}
         animate={{ opacity: 1, y: 0 }}
         transition={{ duration: 0.25, delay: 0.06 }}
       >
         <h3 className="admin-card-title">Základní údaje</h3>
         <div className="admin-form">
-          <div className="offers-form-row-3">
+          <div className="admin-form-row admin-form-row-3">
             <FormField label="Číslo nabídky">
               <input
                 type="text"
                 value={form.quotation_number}
-                onChange={(e) =>
-                  setForm((prev) => ({
-                    ...prev,
-                    quotation_number: e.target.value,
-                  }))
-                }
+                readOnly
                 className="admin-form-input"
+                style={{
+                  backgroundColor: "var(--bg-secondary)",
+                  cursor: "default",
+                }}
               />
             </FormField>
             <FormField label="Kód projektu">
@@ -1007,7 +1039,7 @@ export default function OfferDetail() {
             </FormField>
             <FormField label="Zákazník" error={errors.customer_id}>
               {form.customer_id ? (
-                <div className="offers-customer-selected">
+                <div className="admin-customer-selected">
                   <span>{form.customer_name}</span>
                   {!isInvalidated && !isLockedByOther && (
                     <button
@@ -1032,7 +1064,7 @@ export default function OfferDetail() {
                 </div>
               ) : (
                 <div
-                  className="offers-customer-select"
+                  className="admin-customer-select"
                   onClick={(e) => e.stopPropagation()}
                 >
                   <input
@@ -1048,16 +1080,16 @@ export default function OfferDetail() {
                     readOnly={isInvalidated || isLockedByOther}
                   />
                   {showCustomerDropdown && !isInvalidated && (
-                    <div className="offers-customer-dropdown">
+                    <div className="admin-customer-dropdown">
                       {filteredCustomers.length === 0 ? (
-                        <div className="offers-customer-dropdown-empty">
+                        <div className="admin-customer-dropdown-empty">
                           Žádní zákazníci
                         </div>
                       ) : (
                         filteredCustomers.slice(0, 20).map((c) => (
                           <div
                             key={c.id}
-                            className="offers-customer-dropdown-item"
+                            className="admin-customer-dropdown-item"
                             onMouseDown={() => selectCustomer(c)}
                           >
                             <div>{c.name}</div>
@@ -1125,10 +1157,18 @@ export default function OfferDetail() {
                 className="admin-form-select"
                 disabled={isInvalidated || isLockedByOther}
               >
-                <option value="EUR">EUR</option>
-                <option value="USD">USD</option>
-                <option value="CZK">CZK</option>
-                <option value="GBP">GBP</option>
+                {(
+                  companySettings?.available_currencies || [
+                    "CZK",
+                    "EUR",
+                    "USD",
+                    "GBP",
+                  ]
+                ).map((c) => (
+                  <option key={c} value={c}>
+                    {c}
+                  </option>
+                ))}
               </select>
             </FormField>
             <FormField label="Jazyk nabídky">
@@ -1144,23 +1184,26 @@ export default function OfferDetail() {
             </FormField>
           </div>
 
-          <div className="offers-form-row-3">
+          <div className="admin-form-row admin-form-row-3">
             <FormField label="Sazba DPH (%)">
               <div className="flex-row-gap">
-                <input
-                  type="number"
+                <select
                   value={form.vat_rate}
                   onChange={(e) =>
                     updateForm("vat_rate", parseFloat(e.target.value) || 0)
                   }
-                  className="admin-form-input flex-1"
-                  step="0.1"
-                  readOnly={isInvalidated || isLockedByOther}
-                />
-                <label
-                  className="admin-form-checkbox"
-                  style={{ whiteSpace: "nowrap" }}
+                  className="admin-form-select flex-1"
+                  disabled={isInvalidated || isLockedByOther}
                 >
+                  {(
+                    companySettings?.available_vat_rates || [0, 10, 12, 15, 21]
+                  ).map((r) => (
+                    <option key={r} value={r}>
+                      {r}%
+                    </option>
+                  ))}
+                </select>
+                <label className="admin-form-checkbox whitespace-nowrap">
                   <input
                     type="checkbox"
                     checked={form.apply_vat}
@@ -1281,18 +1324,18 @@ export default function OfferDetail() {
           </div>
 
           {/* Totals */}
-          <div className="offers-totals-summary">
-            <div className="offers-totals-row">
+          <div className="admin-totals-summary">
+            <div className="admin-totals-row">
               <span>Mezisoučet:</span>
               <span>{formatCurrency(subtotal, form.currency)}</span>
             </div>
             {form.apply_vat && (
-              <div className="offers-totals-row">
+              <div className="admin-totals-row">
                 <span>DPH ({form.vat_rate}%):</span>
                 <span>{formatCurrency(vatAmount, form.currency)}</span>
               </div>
             )}
-            <div className="offers-totals-row offers-totals-total">
+            <div className="admin-totals-row admin-totals-total">
               <span>Celkem:</span>
               <span>{formatCurrency(total, form.currency)}</span>
             </div>
@@ -1621,7 +1664,7 @@ export default function OfferDetail() {
                   <FormField label="Příloha (PDF)">
                     {orderAttachment ? (
                       <div className="flex-row gap-2">
-                        <span style={{ fontSize: "0.875rem" }}>
+                        <span className="text-md">
                           {orderAttachment.name}{" "}
                           <span className="text-tertiary">
                             ({(orderAttachment.size / 1024).toFixed(0)} KB)

src/admin/pages/Offers.tsx

@@ -221,26 +221,28 @@ export default function Offers() {
 
   const handlePdf = async (quotation: Quotation) => {
     if (pdfLoading) return;
+    const newWindow = window.open("", "_blank");
     setPdfLoading(quotation.id);
     try {
-      const response = await apiFetch(`${API_BASE}/offers-pdf/${quotation.id}`);
-      if (response.status === 401) return;
-      if (!response.ok) {
-        alert.error("Nepodařilo se vygenerovat PDF");
+      const response = await apiFetch(
+        `${API_BASE}/offers/${quotation.id}/file`,
+      );
+      if (response.status === 401) {
+        newWindow?.close();
         return;
       }
-      const html = await response.text();
-      const w = window.open("", "_blank");
-      if (w) {
-        w.document.open();
-        w.document.write(html);
-        w.document.close();
-        w.onload = () => w.print();
-      } else {
-        alert.error("Prohlížeč zablokoval vyskakovací okno");
+      if (!response.ok) {
+        newWindow?.close();
+        alert.error("PDF soubor nenalezen — otevřete nabídku a uložte ji");
+        return;
       }
+      const blob = await response.blob();
+      const url = URL.createObjectURL(blob);
+      if (newWindow) newWindow.location.href = url;
+      setTimeout(() => URL.revokeObjectURL(url), 60000);
     } catch {
-      alert.error("Chyba při generování PDF");
+      newWindow?.close();
+      alert.error("Chyba připojení");
     } finally {
       setPdfLoading(null);
     }
@@ -324,7 +326,7 @@ export default function Offers() {
           </p>
         </div>
         <div className="admin-page-actions">
-          {hasPermission("offers.settings") && (
+          {hasPermission("settings.manage") && (
             <Link
               to="/offers/templates"
               className="admin-btn admin-btn-secondary"
@@ -753,7 +755,7 @@ export default function Offers() {
                               <button
                                 onClick={() => handlePdf(q)}
                                 className="admin-btn-icon"
-                                title="PDF"
+                                title="Zobrazit nabídku"
                                 disabled={pdfLoading === q.id}
                               >
                                 {pdfLoading === q.id ? (
@@ -812,8 +814,8 @@ export default function Offers() {
                     <tr>
                       <td
                         colSpan={8}
-                        className="text-muted"
-                        style={{ textAlign: "center", padding: "1.5rem" }}
+                        className="text-muted text-center"
+                        style={{ padding: "1.5rem" }}
                       >
                         Žádné nabídky odpovídající hledání.
                       </td>
@@ -877,8 +879,8 @@ export default function Offers() {
               <div className="admin-modal-header">
                 <h2 className="admin-modal-title">Vytvořit objednávku</h2>
                 <p
-                  className="text-secondary"
-                  style={{ marginTop: "0.25rem", fontSize: "0.875rem" }}
+                  className="text-secondary text-md"
+                  style={{ marginTop: "0.25rem" }}
                 >
                   Nabídka:{" "}
                   <strong>{orderModal.quotation?.quotation_number}</strong>
@@ -915,7 +917,7 @@ export default function Offers() {
                           <path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z" />
                           <polyline points="14 2 14 8 20 8" />
                         </svg>
-                        <span style={{ fontSize: "0.875rem" }}>
+                        <span className="text-md">
                           {orderAttachment.name}{" "}
                           <span className="text-tertiary">
                             ({(orderAttachment.size / 1024).toFixed(0)} KB)
@@ -942,11 +944,9 @@ export default function Offers() {
                       </div>
                     ) : (
                       <label
-                        className="admin-btn admin-btn-secondary admin-btn-sm"
+                        className="admin-btn admin-btn-secondary admin-btn-sm inline-flex"
                         style={{
                           cursor: "pointer",
-                          display: "inline-flex",
-                          alignItems: "center",
                           gap: "0.4rem",
                         }}
                       >

src/admin/pages/OffersTemplates.tsx

@@ -55,7 +55,7 @@ export default function OffersTemplates() {
   const { hasPermission } = useAuth();
   const [activeTab, setActiveTab] = useState<"items" | "scopes">("items");
 
-  if (!hasPermission("offers.settings")) return <Forbidden />;
+  if (!hasPermission("settings.manage")) return <Forbidden />;
 
   return (
     <div>
@@ -73,15 +73,15 @@ export default function OffersTemplates() {
         </div>
       </motion.div>
 
-      <div className="offers-tabs">
+      <div className="admin-tabs">
         <button
-          className={`offers-tab ${activeTab === "items" ? "active" : ""}`}
+          className={`admin-tab ${activeTab === "items" ? "active" : ""}`}
           onClick={() => setActiveTab("items")}
         >
           Šablony položek
         </button>
         <button
-          className={`offers-tab ${activeTab === "scopes" ? "active" : ""}`}
+          className={`admin-tab ${activeTab === "scopes" ? "active" : ""}`}
           onClick={() => setActiveTab("scopes")}
         >
           Šablony rozsahu
@@ -826,22 +826,19 @@ function ScopeTemplatesTab() {
 
                   <div className="admin-form-group">
                     <label className="admin-form-label mb-2">Sekce</label>
-                    <div className="offers-scope-list">
+                    <div className="admin-scope-list">
                       {form.sections.map((section, index) => (
-                        <div
-                          key={section._key}
-                          className="offers-scope-section"
-                        >
-                          <div className="offers-scope-section-header">
-                            <span className="offers-scope-number">
+                        <div key={section._key} className="admin-scope-section">
+                          <div className="admin-scope-section-header">
+                            <span className="admin-scope-number">
                               {index + 1}.
                             </span>
-                            <span className="offers-scope-title">
+                            <span className="admin-scope-title">
                               {section.title ||
                                 section.title_cz ||
                                 `Sekce ${index + 1}`}
                             </span>
-                            <div className="offers-scope-actions">
+                            <div className="admin-scope-actions">
                               <button
                                 type="button"
                                 onClick={() => moveSection(index, -1)}

src/admin/pages/OrderDetail.tsx

@@ -11,6 +11,7 @@ import { useAuth } from "../context/AuthContext";
 import { useParams, useNavigate, Link } from "react-router-dom";
 import { motion } from "framer-motion";
 import ConfirmModal from "../components/ConfirmModal";
+import OrderConfirmationModal from "../components/OrderConfirmationModal";
 import FormField from "../components/FormField";
 import Forbidden from "../components/Forbidden";
 
@@ -112,13 +113,12 @@ export default function OrderDetail() {
     show: boolean;
     status: string | null;
   }>({ show: false, status: null });
-  const [editingNumber, setEditingNumber] = useState(false);
-  const [orderNumber, setOrderNumber] = useState("");
-  const [savingNumber, setSavingNumber] = useState(false);
   const [attachmentLoading, setAttachmentLoading] = useState(false);
   const [deleteConfirm, setDeleteConfirm] = useState(false);
   const [deleting, setDeleting] = useState(false);
   const [deleteFiles, setDeleteFiles] = useState(false);
+  const [showConfirmationModal, setShowConfirmationModal] = useState(false);
+  const [confirmationLoading, setConfirmationLoading] = useState(false);
 
   const fetchDetail = useCallback(async () => {
     try {
@@ -186,42 +186,6 @@ export default function OrderDetail() {
     }
   };
 
-  const handleStartEditNumber = () => {
-    if (!order) return;
-    setOrderNumber(order.order_number);
-    setEditingNumber(true);
-  };
-
-  const handleSaveNumber = async () => {
-    if (!order) return;
-    const trimmed = orderNumber.trim();
-    if (!trimmed) return;
-    if (trimmed === order.order_number) {
-      setEditingNumber(false);
-      return;
-    }
-    setSavingNumber(true);
-    try {
-      const response = await apiFetch(`${API_BASE}/orders/${id}`, {
-        method: "PUT",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ order_number: trimmed }),
-      });
-      const result = await response.json();
-      if (result.success) {
-        alert.success("Číslo objednávky bylo změněno");
-        setEditingNumber(false);
-        fetchDetail();
-      } else {
-        alert.error(result.error || "Nepodařilo se změnit číslo");
-      }
-    } catch {
-      alert.error("Chyba připojení");
-    } finally {
-      setSavingNumber(false);
-    }
-  };
-
   const handleSaveNotes = async () => {
     setSaving(true);
     try {
@@ -265,6 +229,49 @@ export default function OrderDetail() {
     }
   };
 
+  const handleGenerateConfirmation = async (
+    lang: string,
+    applyVat: boolean,
+    customItems?: Array<{
+      description: string;
+      quantity: number;
+      unit: string;
+      unit_price: number;
+      is_included_in_total: boolean;
+      vat_rate: number;
+    }>,
+  ) => {
+    setConfirmationLoading(true);
+    try {
+      const response = await apiFetch(
+        `${API_BASE}/orders-pdf/${id}/confirmation`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ lang, applyVat, items: customItems }),
+        },
+      );
+      if (!response.ok) {
+        const result = await response.json().catch(() => ({}));
+        alert.error(result.error || "Nepodařilo se vygenerovat PDF");
+        return;
+      }
+      const blob = await response.blob();
+      const url = URL.createObjectURL(blob);
+      const a = document.createElement("a");
+      a.href = url;
+      a.download = `Potvrzeni-${order?.order_number || String(id)}.pdf`;
+      document.body.appendChild(a);
+      a.click();
+      document.body.removeChild(a);
+      setTimeout(() => URL.revokeObjectURL(url), 60000);
+    } catch {
+      alert.error("Chyba připojení");
+    } finally {
+      setConfirmationLoading(false);
+    }
+  };
+
   const handleDelete = async () => {
     setDeleting(true);
     try {
@@ -361,102 +368,7 @@ export default function OrderDetail() {
           </Link>
           <div>
             <h1 className="admin-page-title flex-row-gap">
-              {editingNumber ? (
-                <span
-                  style={{
-                    display: "inline-flex",
-                    alignItems: "center",
-                    gap: "0.5rem",
-                  }}
-                >
-                  Objednávka
-                  <input
-                    type="text"
-                    value={orderNumber}
-                    onChange={(e) => setOrderNumber(e.target.value)}
-                    onKeyDown={(e) => {
-                      if (e.key === "Enter") handleSaveNumber();
-                      if (e.key === "Escape") setEditingNumber(false);
-                    }}
-                    className="admin-form-input"
-                    style={{
-                      width: "10rem",
-                      fontSize: "1rem",
-                      padding: "0.25rem 0.5rem",
-                      height: "auto",
-                    }}
-                    autoFocus
-                    disabled={savingNumber}
-                  />
-                  <button
-                    onClick={handleSaveNumber}
-                    className="admin-btn-icon"
-                    title="Uložit"
-                    aria-label="Uložit"
-                    disabled={savingNumber}
-                  >
-                    <svg
-                      width="18"
-                      height="18"
-                      viewBox="0 0 24 24"
-                      fill="none"
-                      stroke="var(--accent-color)"
-                      strokeWidth="2"
-                    >
-                      <polyline points="20 6 9 17 4 12" />
-                    </svg>
-                  </button>
-                  <button
-                    onClick={() => setEditingNumber(false)}
-                    className="admin-btn-icon"
-                    title="Zrušit"
-                    aria-label="Zrušit"
-                    disabled={savingNumber}
-                  >
-                    <svg
-                      width="18"
-                      height="18"
-                      viewBox="0 0 24 24"
-                      fill="none"
-                      stroke="currentColor"
-                      strokeWidth="2"
-                    >
-                      <path d="M18 6L6 18M6 6l12 12" />
-                    </svg>
-                  </button>
-                </span>
-              ) : (
-                <span
-                  style={{
-                    display: "inline-flex",
-                    alignItems: "center",
-                    gap: "0.5rem",
-                  }}
-                >
-                  Objednávka {order.order_number}
-                  {hasPermission("orders.edit") && (
-                    <button
-                      onClick={handleStartEditNumber}
-                      className="admin-btn-icon"
-                      title="Změnit číslo"
-                      aria-label="Změnit číslo"
-                      style={{ opacity: 0.5 }}
-                    >
-                      <svg
-                        width="16"
-                        height="16"
-                        viewBox="0 0 24 24"
-                        fill="none"
-                        stroke="currentColor"
-                        strokeWidth="2"
-                      >
-                        <path d="M11 4H4a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2v-7" />
-                        <path d="M18.5 2.5a2.121 2.121 0 0 1 3 3L12 15l-4 1 1-4 9.5-9.5z" />
-                      </svg>
-                    </button>
-                  )}
-                </span>
-              )}
+              <span>Objednávka {order.order_number}</span>
               <span
                 className={`admin-badge ${STATUS_CLASSES[order.status] || ""}`}
               >
@@ -506,6 +418,24 @@ export default function OrderDetail() {
               </Link>
             )
           )}
+          <button
+            onClick={() => setShowConfirmationModal(true)}
+            className="admin-btn admin-btn-secondary"
+            disabled={confirmationLoading}
+          >
+            <svg
+              width="16"
+              height="16"
+              viewBox="0 0 24 24"
+              fill="none"
+              stroke="currentColor"
+              strokeWidth="2"
+            >
+              <path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z" />
+              <polyline points="14 2 14 8 20 8" />
+            </svg>
+            Potvrzení objednávky
+          </button>
           {hasPermission("orders.edit") &&
             order.valid_transitions?.filter((s) => s !== "stornovana").length! >
               0 &&
@@ -747,18 +677,18 @@ export default function OrderDetail() {
           )}
 
           {/* Totals */}
-          <div className="offers-totals-summary">
-            <div className="offers-totals-row">
+          <div className="admin-totals-summary">
+            <div className="admin-totals-row">
               <span>Mezisoučet:</span>
               <span>{formatCurrency(totals.subtotal, order.currency)}</span>
             </div>
             {Number(order.apply_vat) > 0 && (
-              <div className="offers-totals-row">
+              <div className="admin-totals-row">
                 <span>DPH ({order.vat_rate}%):</span>
                 <span>{formatCurrency(totals.vatAmount, order.currency)}</span>
               </div>
             )}
-            <div className="offers-totals-row offers-totals-total">
+            <div className="admin-totals-row admin-totals-total">
               <span>Celkem k úhradě:</span>
               <span>{formatCurrency(totals.total, order.currency)}</span>
             </div>
@@ -788,16 +718,16 @@ export default function OrderDetail() {
                 {order.scope_description}
               </div>
             )}
-            <div className="offers-scope-list">
+            <div className="admin-scope-list">
               {order.sections.map((section, index) => (
                 <div
                   key={section.id || index}
-                  className="offers-scope-section"
+                  className="admin-scope-section"
                   style={{ cursor: "default" }}
                 >
-                  <div className="offers-scope-section-header">
-                    <span className="offers-scope-number">{index + 1}.</span>
-                    <span className="offers-scope-title">
+                  <div className="admin-scope-section-header">
+                    <span className="admin-scope-number">{index + 1}.</span>
+                    <span className="admin-scope-title">
                       {(order.language === "CZ"
                         ? section.title_cz || section.title
                         : section.title || section.title_cz) ||
@@ -806,7 +736,7 @@ export default function OrderDetail() {
                   </div>
                   {section.content && (
                     <div
-                      className="offers-scope-content rich-text-view"
+                      className="admin-scope-content admin-rich-text-view"
                       style={{ padding: "1rem" }}
                       dangerouslySetInnerHTML={{
                         __html: DOMPurify.sanitize(section.content),
@@ -900,6 +830,26 @@ export default function OrderDetail() {
         type="danger"
         loading={deleting}
       />
+
+      {/* Order confirmation PDF modal */}
+      {order && (
+        <OrderConfirmationModal
+          isOpen={showConfirmationModal}
+          onClose={() => setShowConfirmationModal(false)}
+          onGenerate={handleGenerateConfirmation}
+          initialItems={order.items.map((it) => ({
+            description: it.description || "",
+            quantity: Number(it.quantity) || 0,
+            unit: it.unit || "",
+            unit_price: Number(it.unit_price) || 0,
+            is_included_in_total: Number(it.is_included_in_total) !== 0,
+            vat_rate: Number(order.vat_rate) || 21,
+          }))}
+          orderNumber={order.order_number}
+          defaultVatRate={Number(order.vat_rate) || 21}
+          applyVat={!!order.apply_vat}
+        />
+      )}
     </div>
   );
 }

src/admin/pages/ProjectCreate.tsx

@@ -161,7 +161,6 @@ export default function ProjectCreate() {
         name: form.name.trim(),
         customer_id: form.customer_id,
         start_date: form.start_date,
-        project_number: form.project_number.trim(),
         responsible_user_id: form.responsible_user_id || null,
       };
 
@@ -172,7 +171,7 @@ export default function ProjectCreate() {
       });
       const data = await res.json();
       if (data.success) {
-        navigate(`/projects/${data.data.project_id}`, {
+        navigate(`/projects/${data.data.id}`, {
           state: { created: true },
         });
       } else {
@@ -265,9 +264,12 @@ export default function ProjectCreate() {
                 <input
                   type="text"
                   value={form.project_number}
-                  onChange={(e) => updateForm("project_number", e.target.value)}
+                  readOnly
                   className="admin-form-input"
-                  placeholder="Ponechte prázdné pro automatické"
+                  style={{
+                    backgroundColor: "var(--bg-secondary)",
+                    cursor: "default",
+                  }}
                 />
               </FormField>
               <FormField label="Název" error={errors.name} required>
@@ -284,7 +286,7 @@ export default function ProjectCreate() {
             <div className="admin-form-row">
               <FormField label="Zákazník" error={errors.customer_id} required>
                 {form.customer_id ? (
-                  <div className="offers-customer-selected">
+                  <div className="admin-customer-selected">
                     <span>{form.customer_name}</span>
                     <button
                       type="button"
@@ -308,7 +310,7 @@ export default function ProjectCreate() {
                   </div>
                 ) : (
                   <div
-                    className="offers-customer-select"
+                    className="admin-customer-select"
                     onClick={(e) => e.stopPropagation()}
                   >
                     <input
@@ -323,16 +325,16 @@ export default function ProjectCreate() {
                       placeholder="Hledat zákazníka..."
                     />
                     {showCustomerDropdown && (
-                      <div className="offers-customer-dropdown">
+                      <div className="admin-customer-dropdown">
                         {filteredCustomers.length === 0 ? (
-                          <div className="offers-customer-dropdown-empty">
+                          <div className="admin-customer-dropdown-empty">
                             Žádní zákazníci
                           </div>
                         ) : (
                           filteredCustomers.slice(0, 20).map((c) => (
                             <div
                               key={c.id}
-                              className="offers-customer-dropdown-item"
+                              className="admin-customer-dropdown-item"
                               onMouseDown={() => selectCustomer(c)}
                             >
                               <div>{c.name}</div>

src/admin/pages/ReceivedInvoices.tsx

@@ -21,8 +21,8 @@ const STATUS_CLASSES: Record<string, string> = {
   unpaid: "admin-badge-invoice-overdue",
   paid: "admin-badge-invoice-paid",
 };
-const CURRENCY_OPTIONS = ["CZK", "EUR", "USD", "GBP"];
-const VAT_RATE_OPTIONS = [0, 10, 12, 15, 21];
+const DEFAULT_CURRENCIES = ["CZK", "EUR", "USD", "GBP"];
+const DEFAULT_VAT_RATES = [0, 10, 12, 15, 21];
 
 const MONTH_NAMES = [
   "leden",
@@ -115,7 +115,7 @@ function formatCzkWithDetail(
     return { value: "0 Kč", detail: null };
   }
   const hasForeign = amounts.some((a) => a.currency !== "CZK");
-  if (hasForeign && totalCzk !== null && totalCzk !== undefined) {
+  if (hasForeign && totalCzk != null) {
     return {
       value: formatCurrency(totalCzk, "CZK"),
       detail: formatMultiCurrency(amounts),
@@ -124,13 +124,20 @@ function formatCzkWithDetail(
   return { value: formatMultiCurrency(amounts), detail: null };
 }
 
-function emptyMeta(): UploadMeta {
+interface CompanySettings {
+  default_currency: string;
+  default_vat_rate: number;
+  available_currencies: string[];
+  available_vat_rates: number[];
+}
+
+function emptyMeta(settings: CompanySettings | null): UploadMeta {
   return {
     supplier_name: "",
     invoice_number: "",
     amount: "",
-    currency: "CZK",
-    vat_rate: "21",
+    currency: settings?.default_currency || "CZK",
+    vat_rate: String(settings?.default_vat_rate ?? 21),
     issue_date: "",
     due_date: "",
     notes: "",
@@ -168,6 +175,8 @@ export default function ReceivedInvoices({
   const [saving, setSaving] = useState(false);
 
   const [supplierNames, setSupplierNames] = useState<string[]>([]);
+  const [companySettings, setCompanySettings] =
+    useState<CompanySettings | null>(null);
 
   const [uploadFiles, setUploadFiles] = useState<File[]>([]);
   const [uploadMeta, setUploadMeta] = useState<UploadMeta[]>([]);
@@ -231,6 +240,22 @@ export default function ReceivedInvoices({
       .catch(() => {});
   }, []);
 
+  useEffect(() => {
+    apiFetch(`${API_BASE}/company-settings`)
+      .then((r) => r.json())
+      .then((d) => {
+        if (d.success) setCompanySettings(d.data);
+      })
+      .catch(() => {});
+  }, []);
+
+  const currencyOptions =
+    companySettings?.available_currencies || DEFAULT_CURRENCIES;
+  const vatRateOptions =
+    companySettings?.available_vat_rates || DEFAULT_VAT_RATES;
+  const defaultCurrency = companySettings?.default_currency || "CZK";
+  const defaultVatRate = String(companySettings?.default_vat_rate ?? 21);
+
   // Fetch stats (silent refresh without animation)
   const refreshStats = useCallback(async () => {
     try {
@@ -292,7 +317,10 @@ export default function ReceivedInvoices({
       return true;
     });
     setUploadFiles((prev) => [...prev, ...valid]);
-    setUploadMeta((prev) => [...prev, ...valid.map(() => emptyMeta())]);
+    setUploadMeta((prev) => [
+      ...prev,
+      ...valid.map(() => emptyMeta(companySettings)),
+    ]);
     e.target.value = "";
   };
 
@@ -475,19 +503,22 @@ export default function ReceivedInvoices({
   };
 
   const openFile = async (inv: ReceivedInvoice) => {
+    const newWindow = window.open("", "_blank");
     try {
       const response = await apiFetch(
         `${API_BASE}/received-invoices/${inv.id}/file`,
       );
       if (!response.ok) {
+        newWindow?.close();
         alert.error("Nepodařilo se načíst soubor");
         return;
       }
       const blob = await response.blob();
       const url = URL.createObjectURL(blob);
-      window.open(url, "_blank");
+      if (newWindow) newWindow.location.href = url;
       setTimeout(() => URL.revokeObjectURL(url), 60000);
     } catch {
+      newWindow?.close();
       alert.error("Chyba připojení");
     }
   };
@@ -518,7 +549,7 @@ export default function ReceivedInvoices({
   const renderKpi = () => {
     if (!hasLoadedOnce.current && statsLoading) {
       return (
-        <div className="dash-kpi-grid dash-kpi-4 mb-6">
+        <div className="admin-kpi-grid admin-kpi-4 mb-6">
           {[0, 1, 2, 3].map((i) => (
             <div key={i} className="admin-stat-card">
               <div
@@ -555,7 +586,7 @@ export default function ReceivedInvoices({
         >
           <motion.div
             key={slideKey}
-            className="dash-kpi-grid dash-kpi-4"
+            className="admin-kpi-grid admin-kpi-4"
             custom={slideDirection.current}
             variants={{
               enter: (dir: number) => ({
@@ -678,9 +709,9 @@ export default function ReceivedInvoices({
               <p>Žádné přijaté faktury v tomto měsíci.</p>
               {hasPermission("invoices.create") && (
                 <p
+                  className="text-md"
                   style={{
                     color: "var(--text-tertiary)",
-                    fontSize: "0.875rem",
                   }}
                 >
                   Nahrajte faktury tlačítkem výše.
@@ -749,7 +780,8 @@ export default function ReceivedInvoices({
                       />
                     </th>
                     <th
-                      style={{ textAlign: "right", cursor: "pointer" }}
+                      className="text-right"
+                      style={{ cursor: "pointer" }}
                       onClick={() => handleSort("amount")}
                     >
                       Částka{" "}
@@ -928,9 +960,9 @@ export default function ReceivedInvoices({
                     Vybrat soubory
                   </button>
                   <span
+                    className="text-sm"
                     style={{
                       marginLeft: "0.75rem",
-                      fontSize: "0.8125rem",
                       color: "var(--text-tertiary)",
                     }}
                   >
@@ -1041,12 +1073,14 @@ export default function ReceivedInvoices({
                           <FormField label="Měna" style={{ width: "90px" }}>
                             <select
                               className="admin-form-select"
-                              value={uploadMeta[idx]?.currency || "CZK"}
+                              value={
+                                uploadMeta[idx]?.currency || defaultCurrency
+                              }
                               onChange={(e) =>
                                 updateMeta(idx, "currency", e.target.value)
                               }
                             >
-                              {CURRENCY_OPTIONS.map((c) => (
+                              {currencyOptions.map((c) => (
                                 <option key={c} value={c}>
                                   {c}
                                 </option>
@@ -1056,12 +1090,14 @@ export default function ReceivedInvoices({
                           <FormField label="DPH %" style={{ width: "90px" }}>
                             <select
                               className="admin-form-select"
-                              value={uploadMeta[idx]?.vat_rate || "21"}
+                              value={
+                                uploadMeta[idx]?.vat_rate || defaultVatRate
+                              }
                               onChange={(e) =>
                                 updateMeta(idx, "vat_rate", e.target.value)
                               }
                             >
-                              {VAT_RATE_OPTIONS.map((r) => (
+                              {vatRateOptions.map((r) => (
                                 <option key={r} value={String(r)}>
                                   {r}%
                                 </option>
@@ -1071,8 +1107,8 @@ export default function ReceivedInvoices({
                         </div>
                         {uploadMeta[idx]?.amount && (
                           <div
+                            className="text-xs"
                             style={{
-                              fontSize: "0.75rem",
                               color: "var(--text-tertiary)",
                               marginTop: "-0.25rem",
                               marginBottom: "0.5rem",
@@ -1085,14 +1121,14 @@ export default function ReceivedInvoices({
                                   uploadMeta[idx].amount || "0",
                                 );
                                 const r = parseFloat(
-                                  uploadMeta[idx].vat_rate || "21",
+                                  uploadMeta[idx].vat_rate || defaultVatRate,
                                 );
                                 return r > 0
                                   ? Math.round((a - a / (1 + r / 100)) * 100) /
                                       100
                                   : 0;
                               })(),
-                              uploadMeta[idx].currency || "CZK",
+                              uploadMeta[idx].currency || defaultCurrency,
                             )}
                           </div>
                         )}
@@ -1255,7 +1291,7 @@ export default function ReceivedInvoices({
                               }
                               disabled={ro}
                             >
-                              {CURRENCY_OPTIONS.map((c) => (
+                              {currencyOptions.map((c) => (
                                 <option key={c} value={c}>
                                   {c}
                                 </option>
@@ -1275,7 +1311,7 @@ export default function ReceivedInvoices({
                               }
                               disabled={ro}
                             >
-                              {VAT_RATE_OPTIONS.map((r) => (
+                              {vatRateOptions.map((r) => (
                                 <option key={r} value={String(r)}>
                                   {r}%
                                 </option>
@@ -1285,8 +1321,8 @@ export default function ReceivedInvoices({
                         </div>
                         {editInvoice.amount && (
                           <div
+                            className="text-xs"
                             style={{
-                              fontSize: "0.75rem",
                               color: "var(--text-tertiary)",
                               marginBottom: "0.75rem",
                             }}
@@ -1296,14 +1332,14 @@ export default function ReceivedInvoices({
                               (() => {
                                 const a = parseFloat(editInvoice.amount || "0");
                                 const r = parseFloat(
-                                  editInvoice.vat_rate || "21",
+                                  editInvoice.vat_rate || defaultVatRate,
                                 );
                                 return r > 0
                                   ? Math.round((a - a / (1 + r / 100)) * 100) /
                                       100
                                   : 0;
                               })(),
-                              editInvoice.currency || "CZK",
+                              editInvoice.currency || defaultCurrency,
                             )}
                           </div>
                         )}

src/admin/pages/TripsAdmin.tsx

@@ -89,6 +89,7 @@ export default function TripsAdmin() {
   const alert = useAlert();
   const { hasPermission } = useAuth();
   const [loading, setLoading] = useState(true);
+  const [companyName, setCompanyName] = useState("");
   const [filterMonth, setFilterMonth] = useState(() =>
     String(new Date().getMonth() + 1),
   );
@@ -124,22 +125,18 @@ export default function TripsAdmin() {
   useEffect(() => {
     const fetchLookups = async () => {
       try {
-        const [vRes, uRes] = await Promise.all([
+        const [vRes, uRes, csRes] = await Promise.all([
           apiFetch(`${API_BASE}/vehicles`),
-          apiFetch(`${API_BASE}/users?limit=1000`),
+          apiFetch(`${API_BASE}/trips/users`),
+          apiFetch(`${API_BASE}/company-settings`),
         ]);
         const vJson = await vRes.json();
         const uJson = await uRes.json();
+        const csJson = await csRes.json();
         if (vJson.success) setVehicles(vJson.data);
+        if (csJson.success) setCompanyName(csJson.data.company_name || "");
         if (uJson.success) {
-          setUsers(
-            uJson.data.map(
-              (u: { id: number; first_name: string; last_name: string }) => ({
-                id: u.id,
-                name: `${u.first_name} ${u.last_name}`,
-              }),
-            ),
-          );
+          setUsers(uJson.data);
         }
       } catch {
         // silently fail, filters will just be empty
@@ -886,13 +883,13 @@ export default function TripsAdmin() {
           <div className="print-header">
             <div className="print-header-left">
               <img
-                src="/images/logo-light.png"
-                alt="BOHA"
+                src="/api/admin/company-settings/logo?variant=light"
+                alt=""
                 className="print-logo"
               />
               <div className="print-header-text">
                 <h1>KNIHA JÍZD</h1>
-                <div className="company">BOHA Automation s.r.o.</div>
+                <div className="company">{companyName}</div>
               </div>
             </div>
             <div className="print-header-right">

src/admin/pagination.css

@@ -0,0 +1,91 @@
+/* ============================================================================
+   Pagination
+   ============================================================================ */
+
+.admin-pagination {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.75rem;
+  padding: 0.75rem 1rem;
+  margin-top: 0.5rem;
+  border-top: 1px solid var(--border-color);
+  font-size: 13px;
+}
+
+.admin-pagination-info {
+  color: var(--text-muted);
+  font-family: var(--font-mono);
+  font-size: 12px;
+  white-space: nowrap;
+}
+
+.admin-pagination-controls {
+  display: flex;
+  align-items: center;
+  gap: 2px;
+}
+
+.admin-pagination-page {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  min-width: 32px;
+  height: 32px;
+  padding: 0 6px;
+  border: 1px solid transparent;
+  border-radius: var(--border-radius-sm);
+  background: none;
+  color: var(--text-secondary);
+  font-size: 13px;
+  font-family: var(--font-mono);
+  cursor: pointer;
+  transition:
+    background 0.15s,
+    color 0.15s,
+    border-color 0.15s;
+}
+
+.admin-pagination-page:hover {
+  background: var(--bg-secondary);
+  color: var(--text-primary);
+}
+
+.admin-pagination-page.active {
+  background: var(--accent-color);
+  color: #fff;
+  border-color: var(--accent-color);
+  font-weight: 600;
+}
+
+.admin-pagination-ellipsis {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 28px;
+  color: var(--text-muted);
+  font-size: 14px;
+}
+
+.admin-pagination-select {
+  padding: 4px 8px;
+  border: 1px solid var(--border-color);
+  border-radius: var(--border-radius-sm);
+  background: var(--bg-primary);
+  color: var(--text-secondary);
+  font-size: 12px;
+  cursor: pointer;
+}
+
+@media (max-width: 640px) {
+  .admin-pagination {
+    flex-wrap: wrap;
+    gap: 0.5rem;
+  }
+
+  .admin-pagination-info {
+    order: 2;
+    width: 100%;
+    text-align: center;
+  }
+}

src/admin/responsive.css

@@ -0,0 +1,6 @@
+/* ============================================================================
+   Responsive — Cross-component media queries
+   ============================================================================
+   Component-specific media queries live in their respective files.
+   This file is reserved for responsive rules that span multiple components.
+   ============================================================================ */

src/admin/skeleton.css

@@ -0,0 +1,72 @@
+/* ============================================================================
+   Skeleton Loading
+   ============================================================================ */
+
+.admin-skeleton {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+  padding: 1.5rem;
+  opacity: 0;
+  animation: skeleton-fade-in 0.15s ease 0.08s forwards;
+}
+
+@keyframes skeleton-fade-in {
+  to {
+    opacity: 1;
+  }
+}
+
+.admin-skeleton-row {
+  display: flex;
+  gap: 1rem;
+  align-items: center;
+}
+
+.admin-skeleton-line {
+  height: 14px;
+  border-radius: 6px;
+  background: linear-gradient(
+    90deg,
+    var(--bg-tertiary) 25%,
+    var(--border-color) 50%,
+    var(--bg-tertiary) 75%
+  );
+  background-size: 200% 100%;
+  animation: shimmer 1.2s ease-in-out infinite;
+}
+
+.admin-skeleton-line.w-full {
+  width: 100%;
+}
+.admin-skeleton-line.w-3\/4 {
+  width: 75%;
+}
+.admin-skeleton-line.w-1\/2 {
+  width: 50%;
+}
+.admin-skeleton-line.w-1\/3 {
+  width: 33%;
+}
+.admin-skeleton-line.w-1\/4 {
+  width: 25%;
+}
+.admin-skeleton-line.h-8 {
+  height: 32px;
+}
+.admin-skeleton-line.h-10 {
+  height: 40px;
+}
+.admin-skeleton-line.circle {
+  width: 40px;
+  height: 40px;
+  border-radius: 50%;
+  flex-shrink: 0;
+}
+
+/* Skeleton loading on mobile */
+@media (max-width: 640px) {
+  .admin-skeleton {
+    border-radius: 4px;
+  }
+}

src/admin/tables.css

@@ -0,0 +1,132 @@
+/* ============================================================================
+   Tables
+   ============================================================================ */
+
+.admin-table-wrapper,
+.admin-table-responsive {
+  overflow-x: auto;
+  -webkit-overflow-scrolling: touch;
+}
+
+.admin-table {
+  width: 100%;
+  min-width: 650px;
+  border-collapse: collapse;
+}
+
+.admin-table th {
+  text-align: left;
+  padding: 10px 16px;
+  font-size: 11px;
+  font-weight: 600;
+  color: var(--text-muted);
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  border-bottom: 1px solid var(--border-color);
+  white-space: nowrap;
+}
+
+.admin-table td {
+  padding: 11px 16px;
+  border-bottom: 1px solid var(--border-color);
+  color: var(--text-secondary);
+  font-size: 13px;
+  line-height: 1.5;
+  white-space: nowrap;
+}
+
+.admin-table tr:last-child td {
+  border-bottom: none;
+}
+
+@media (max-width: 768px) {
+  .admin-table th,
+  .admin-table td {
+    padding: 8px 10px;
+    font-size: 12px;
+  }
+
+  .admin-table th {
+    font-size: 10px;
+  }
+
+  .admin-table-avatar {
+    width: 32px;
+    height: 32px;
+    font-size: 11px;
+  }
+
+  .admin-table-name {
+    font-size: 12px;
+  }
+
+  .admin-table-username {
+    font-size: 11px;
+  }
+}
+
+.admin-table-user {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  white-space: nowrap;
+}
+
+.admin-table-avatar {
+  width: 34px;
+  height: 34px;
+  border-radius: 50%;
+  background: var(--accent-light);
+  color: var(--accent-color);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 600;
+  font-size: 12px;
+}
+
+.admin-table-name {
+  font-weight: 500;
+  color: var(--text-primary);
+  white-space: nowrap;
+}
+
+.admin-table-username {
+  font-size: 13px;
+  color: var(--text-muted);
+  white-space: nowrap;
+}
+
+.admin-table-actions {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
+
+/* Tables - compact on mobile, better scroll indication */
+@media (max-width: 640px) {
+  .admin-table-wrapper,
+  .admin-table-responsive {
+    margin: 0 -1rem;
+    padding: 0 1rem;
+    position: relative;
+  }
+
+  .admin-table {
+    min-width: 500px;
+  }
+
+  .admin-table th,
+  .admin-table td {
+    padding: 8px;
+    font-size: 11px;
+  }
+
+  .admin-table th {
+    font-size: 9px;
+  }
+
+  .admin-table-actions {
+    gap: 0.25rem;
+  }
+}

src/admin/variables.css

@@ -0,0 +1,159 @@
+/* ============================================================================
+   CSS Variables
+   ============================================================================ */
+
+:root {
+  /* Spacing scale */
+  --space-1: 0.25rem;
+  --space-2: 0.5rem;
+  --space-3: 0.75rem;
+  --space-4: 1rem;
+  --space-5: 1.25rem;
+  --space-6: 1.5rem;
+  --space-8: 2rem;
+  --space-10: 2.5rem;
+  --space-12: 3rem;
+
+  /* Shared colors */
+  --accent-color: #d63031;
+  --accent-hover: #b52626;
+  --success: #22c55e;
+  --warning: #f59e0b;
+  --danger: #ef4444;
+  --info: #3b82f6;
+  --error: var(--danger);
+  --muted: #9ca3af;
+  --gradient: #d63031;
+  --gradient-subtle: rgba(214, 48, 49, 0.9);
+
+  /* Shared layout */
+  --border-radius: 10px;
+  --border-radius-sm: 8px;
+  --border-radius-lg: 16px;
+  --transition: all 0.3s cubic-bezier(0.4, 0, 0.2, 1);
+  --transition-slow: all 0.5s cubic-bezier(0.4, 0, 0.2, 1);
+  --font-heading: "Urbanist", sans-serif;
+  --font-body: "Plus Jakarta Sans", sans-serif;
+  --font-mono: "DM Mono", "Menlo", monospace;
+  --safe-top: env(safe-area-inset-top, 0px);
+  --safe-bottom: env(safe-area-inset-bottom, 0px);
+  --safe-left: env(safe-area-inset-left, 0px);
+  --safe-right: env(safe-area-inset-right, 0px);
+  --navbar-height: calc(76px + var(--safe-top));
+}
+
+/* ---- Dark theme ---- */
+[data-theme="dark"] {
+  --bg-primary: #0f0f0f;
+  --bg-secondary: #171717;
+  --bg-tertiary: #1e1e1e;
+  --text-primary: #ffffff;
+  --text-secondary: #a0a0a0;
+  --text-muted: #666666;
+  --text-tertiary: #555555;
+  --border-color: rgba(255, 255, 255, 0.08);
+  --border-color-hover: rgba(255, 255, 255, 0.15);
+  --glass-bg: #171717;
+  --glass-bg-solid: #171717;
+  --glass-border: rgba(255, 255, 255, 0.08);
+  --glass-shadow: 0 1px 3px rgba(0, 0, 0, 0.2), 0 4px 16px rgba(0, 0, 0, 0.15);
+  --card-bg: #1a1a1a;
+  --card-bg-hover: #1e1e1e;
+  --input-bg: #1a1a1a;
+  --glow-color: rgba(214, 48, 49, 0.15);
+  --accent-light: rgba(214, 48, 49, 0.1);
+  --accent-soft: #2a1a1a;
+  --accent-glow: rgba(214, 48, 49, 0.3);
+  --success-light: rgba(34, 197, 94, 0.1);
+  --success-soft: #1a2a1e;
+  --warning-light: rgba(245, 158, 11, 0.1);
+  --warning-soft: #2a2518;
+  --danger-light: rgba(239, 68, 68, 0.1);
+  --danger-soft: #2a1a1a;
+  --info-light: rgba(59, 130, 246, 0.1);
+  --info-soft: #1a1e2a;
+  --muted-light: rgba(107, 114, 128, 0.15);
+  --orb-color-1: rgba(214, 48, 49, 0.2);
+  --orb-color-2: rgba(120, 119, 198, 0.15);
+  --calendar-icon-filter: invert(1);
+  --select-arrow: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 24 24' fill='none' stroke='%23a0a0a0' stroke-width='2'%3E%3Cpath d='M6 9l6 6 6-6'/%3E%3C/svg%3E");
+  --table-row-hover: rgba(255, 255, 255, 0.02);
+  --row-current: color-mix(in srgb, var(--success) 5%, transparent);
+  --row-current-hover: color-mix(in srgb, var(--success) 8%, transparent);
+  --row-draft: color-mix(in srgb, var(--warning) 6%, transparent);
+  --row-expired: color-mix(in srgb, var(--danger) 5%, transparent);
+}
+
+/* ---- Light theme ---- */
+[data-theme="light"] {
+  --success: #15803d;
+  --warning: #b45309;
+  --danger: #b91c1c;
+  --info: #1d4ed8;
+  --accent-color: #c73030;
+  --accent-hover: #b52828;
+  --muted: #6b7280;
+  --bg-primary: #f5f4f2;
+  --bg-secondary: #ffffff;
+  --bg-tertiary: #eeecea;
+  --text-primary: #1a1a1a;
+  --text-secondary: #555555;
+  --text-muted: #717180;
+  --text-tertiary: #8a8a96;
+  --border-color: rgba(0, 0, 0, 0.1);
+  --border-color-hover: rgba(0, 0, 0, 0.18);
+  --glass-bg: #ffffff;
+  --glass-bg-solid: #ffffff;
+  --glass-border: rgba(0, 0, 0, 0.08);
+  --glass-shadow: 0 1px 3px rgba(0, 0, 0, 0.06), 0 4px 16px rgba(0, 0, 0, 0.04);
+  --card-bg: #ffffff;
+  --card-bg-hover: #ffffff;
+  --input-bg: #ffffff;
+  --glow-color: rgba(222, 58, 58, 0.08);
+  --accent-light: rgba(222, 58, 58, 0.08);
+  --accent-soft: #fff0f0;
+  --accent-glow: rgba(222, 58, 58, 0.15);
+  --success-light: rgba(34, 197, 94, 0.1);
+  --success-soft: #e8fbf7;
+  --warning-light: rgba(245, 158, 11, 0.1);
+  --warning-soft: #fef9ec;
+  --danger-light: rgba(239, 68, 68, 0.1);
+  --danger-soft: #fef2f2;
+  --info-light: rgba(59, 130, 246, 0.1);
+  --info-soft: #ebf3fd;
+  --muted-light: rgba(107, 114, 128, 0.12);
+  --calendar-icon-filter: none;
+  --select-arrow: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 24 24' fill='none' stroke='%23555555' stroke-width='2'%3E%3Cpath d='M6 9l6 6 6-6'/%3E%3C/svg%3E");
+  --table-row-hover: rgba(0, 0, 0, 0.03);
+  --row-current: var(--success-soft);
+  --row-current-hover: color-mix(in srgb, var(--success) 12%, transparent);
+  --row-draft: var(--warning-soft);
+  --row-expired: var(--danger-soft);
+  --orb-color-1: rgba(214, 48, 49, 0.12);
+  --orb-color-2: rgba(120, 119, 198, 0.1);
+}
+
+/* Light mode - jemnejsi stiny */
+[data-theme="light"] .admin-toast {
+  box-shadow:
+    0 2px 8px rgba(0, 0, 0, 0.08),
+    0 1px 3px rgba(0, 0, 0, 0.06);
+}
+
+[data-theme="light"] .react-datepicker {
+  box-shadow: 0 4px 16px rgba(0, 0, 0, 0.1) !important;
+}
+
+[data-theme="light"] .admin-rich-editor .ql-snow .ql-picker-options,
+[data-theme="light"] .admin-rich-editor .ql-snow .ql-tooltip {
+  box-shadow: 0 4px 12px rgba(0, 0, 0, 0.08);
+}
+
+[data-theme="light"] .admin-customer-dropdown,
+[data-theme="light"] .offers-template-menu {
+  box-shadow: 0 4px 12px rgba(0, 0, 0, 0.08);
+}
+
+[data-theme="light"] .dash-quick-btn:hover {
+  filter: brightness(0.9);
+}

src/config/env.ts

@@ -63,7 +63,7 @@ export const config = {
     contactTo: process.env.CONTACT_EMAIL_TO || "",
     contactFrom: process.env.CONTACT_EMAIL_FROM || "",
     smtpFrom: process.env.SMTP_FROM || "",
-    smtpFromName: process.env.SMTP_FROM_NAME || "BOHA Automation",
+    smtpFromName: process.env.SMTP_FROM_NAME || "",
     leaveNotify: process.env.LEAVE_NOTIFY_EMAIL || "",
     invoiceAlert: process.env.INVOICE_ALERT_EMAIL || "",
   },
@@ -75,8 +75,6 @@ export const config = {
   },
 
   security: {
-    maxLoginAttempts: 5,
-    lockoutMinutes: 15,
     bcryptCost: 12,
   },
 } as const;

src/middleware/security.ts

@@ -22,8 +22,8 @@ export async function securityHeaders(
       "Content-Security-Policy",
       [
         "default-src 'self'",
-        "script-src 'self' https://unpkg.com",
-        "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://unpkg.com",
+        "script-src 'self'",
+        "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
         "font-src 'self' https://fonts.gstatic.com",
         "img-src 'self' data: blob: https://*.tile.openstreetmap.org",
         "connect-src 'self' https://nominatim.openstreetmap.org",

src/routes/admin/attendance.ts

@@ -1,4 +1,5 @@
 import { FastifyInstance } from "fastify";
+import prisma from "../../config/database";
 import { requireAuth, requirePermission } from "../../middleware/auth";
 import { logAudit } from "../../services/audit";
 import { success, error, parseId } from "../../utils/response";
@@ -132,6 +133,38 @@ export default async function attendanceRoutes(
       return reply.send({ success: true, data });
     }
 
+    // --- action=attendance_users: users with attendance.record permission ---
+    if (action === "attendance_users") {
+      const users = await prisma.users.findMany({
+        where: {
+          is_active: true,
+          roles: {
+            is: {
+              OR: [
+                { name: "admin" },
+                {
+                  role_permissions: {
+                    some: { permissions: { name: "attendance.record" } },
+                  },
+                },
+              ],
+            },
+          },
+        },
+        select: { id: true, first_name: true, last_name: true, username: true },
+        orderBy: { last_name: "asc" },
+      });
+      return reply.send({
+        success: true,
+        data: users.map((u) => ({
+          id: u.id,
+          first_name: u.first_name,
+          last_name: u.last_name,
+          username: u.username,
+        })),
+      });
+    }
+
     // --- action=projects: active projects for attendance project switching ---
     if (action === "projects") {
       const data = await attendanceService.getActiveProjects();

src/routes/admin/bank-accounts.ts

@@ -14,7 +14,7 @@ export default async function bankAccountsRoutes(
 ): Promise<void> {
   fastify.get(
     "/",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (_request, reply) => {
       const accounts = await prisma.bank_accounts.findMany({
         orderBy: { position: "asc" },
@@ -25,7 +25,7 @@ export default async function bankAccountsRoutes(
 
   fastify.post(
     "/",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const parsed = parseBody(CreateBankAccountSchema, request.body);
       if ("error" in parsed) return error(reply, parsed.error, 400);
@@ -59,7 +59,7 @@ export default async function bankAccountsRoutes(
 
   fastify.put<{ Params: { id: string } }>(
     "/:id",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const id = parseId(request.params.id, reply);
       if (id === null) return;
@@ -126,7 +126,7 @@ export default async function bankAccountsRoutes(
 
   fastify.delete<{ Params: { id: string } }>(
     "/:id",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const id = parseId(request.params.id, reply);
       if (id === null) return;

src/routes/admin/company-settings.ts

@@ -5,7 +5,13 @@ import { logAudit } from "../../services/audit";
 import { success, error } from "../../utils/response";
 import multipart from "@fastify/multipart";
 import { parseBody } from "../../schemas/common";
-import { UpdateCompanySettingsSchema } from "../../schemas/company-settings.schema";
+import { UpdateCompanySettingsSchema } from "../../schemas/settings.schema";
+import { invalidateSettingsCache } from "../../services/system-settings";
+import os from "os";
+import { config } from "../../config/env";
+import { NasFileManager } from "../../services/nas-file-manager";
+import { nasFinancialsManager } from "../../services/nas-financials-manager";
+import { nasOffersManager } from "../../services/nas-offers-manager";
 
 /** Encode custom_fields + supplier_field_order into a single JSON blob (matching PHP format) */
 function encodeCustomFields(
@@ -53,27 +59,37 @@ export default async function companySettingsRoutes(
 ): Promise<void> {
   await fastify.register(multipart, { limits: { fileSize: 5 * 1024 * 1024 } });
 
-  // GET /api/admin/company-settings/logo
-  fastify.get("/logo", { preHandler: requireAuth }, async (_request, reply) => {
-    const settings = await prisma.company_settings.findFirst({
-      select: { logo_data: true },
-    });
-    if (!settings?.logo_data) return error(reply, "Logo nenalezeno", 404);
+  // GET /api/admin/company-settings/logo?variant=light|dark
+  fastify.get("/logo", { preHandler: requireAuth }, async (request, reply) => {
+    const query = request.query as Record<string, string>;
+    const variant = query.variant === "dark" ? "dark" : "light";
+    const column = variant === "dark" ? "logo_data_dark" : "logo_data";
+
+    const settings = await prisma.company_settings.findFirst({
+      select: { [column]: true },
+    });
+    const buf = settings?.[column] as unknown as Buffer | null;
+    if (!buf) return error(reply, "Logo nenalezeno", 404);
 
-    // Detect image type from magic bytes
-    const buf = settings.logo_data;
     let mime = "image/png";
     if (buf[0] === 0xff && buf[1] === 0xd8) mime = "image/jpeg";
     else if (buf[0] === 0x47 && buf[1] === 0x49) mime = "image/gif";
 
-    return reply.type(mime).send(buf);
+    return reply
+      .type(mime)
+      .header("Cache-Control", "public, max-age=3600")
+      .send(buf);
   });
 
-  // POST /api/admin/company-settings/logo
+  // POST /api/admin/company-settings/logo?variant=light|dark
   fastify.post(
     "/logo",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
+      const query = request.query as Record<string, string>;
+      const variant = query.variant === "dark" ? "dark" : "light";
+      const column = variant === "dark" ? "logo_data_dark" : "logo_data";
+
       const file = await request.file();
       if (!file) return error(reply, "Nebyl nahrán žádný soubor", 400);
 
@@ -92,7 +108,7 @@ export default async function companySettingsRoutes(
 
       await prisma.company_settings.update({
         where: { id: existing.id },
-        data: { logo_data: new Uint8Array(buffer), modified_at: new Date() },
+        data: { [column]: new Uint8Array(buffer), modified_at: new Date() },
       });
 
       await logAudit({
@@ -101,7 +117,7 @@ export default async function companySettingsRoutes(
         action: "update",
         entityType: "company_settings",
         entityId: existing.id,
-        description: "Nahráno logo",
+        description: `Nahráno logo (${variant})`,
       });
       return success(reply, null, 200, "Logo nahráno");
     },
@@ -129,6 +145,22 @@ export default async function companySettingsRoutes(
         order_type_code: true,
         invoice_type_code: true,
         require_2fa: true,
+        break_threshold_hours: true,
+        break_duration_short: true,
+        break_duration_long: true,
+        clock_rounding_minutes: true,
+        invoice_alert_email: true,
+        leave_notify_email: true,
+        max_login_attempts: true,
+        lockout_minutes: true,
+        max_requests_per_minute: true,
+        available_vat_rates: true,
+        available_currencies: true,
+        smtp_from: true,
+        smtp_from_name: true,
+        offer_number_pattern: true,
+        order_number_pattern: true,
+        invoice_number_pattern: true,
       },
     });
 
@@ -160,32 +192,156 @@ export default async function companySettingsRoutes(
           order_type_code: true,
           invoice_type_code: true,
           require_2fa: true,
+          break_threshold_hours: true,
+          break_duration_short: true,
+          break_duration_long: true,
+          clock_rounding_minutes: true,
+          invoice_alert_email: true,
+          leave_notify_email: true,
+          max_login_attempts: true,
+          lockout_minutes: true,
+          max_requests_per_minute: true,
+          available_vat_rates: true,
+          available_currencies: true,
+          smtp_from: true,
+          smtp_from_name: true,
+          offer_number_pattern: true,
+          order_number_pattern: true,
+          invoice_number_pattern: true,
         },
       });
     }
+    if (!settings) return error(reply, "Nastavení nenalezeno", 500);
 
     // Check if logo exists
     const logoCheck = await prisma.company_settings.findFirst({
       where: { id: settings.id },
-      select: { logo_data: true },
+      select: { logo_data: true, logo_data_dark: true },
     });
     const has_logo = !!logoCheck?.logo_data;
+    const has_logo_dark = !!logoCheck?.logo_data_dark;
 
     const { custom_fields, supplier_field_order } = decodeCustomFields(
       settings.custom_fields as string | null,
     );
 
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const pkg = require("../../../package.json") as { version: string };
+
+    let available_vat_rates: number[] = [0, 10, 12, 15, 21];
+    try {
+      const raw = settings.available_vat_rates as string | null;
+      if (raw) {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed) && parsed.length > 0)
+          available_vat_rates = parsed;
+      }
+    } catch {
+      /* ignore */
+    }
+
+    let available_currencies: string[] = ["CZK", "EUR", "USD", "GBP"];
+    try {
+      const raw = settings.available_currencies as string | null;
+      if (raw) {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed) && parsed.length > 0)
+          available_currencies = parsed;
+      }
+    } catch {
+      /* ignore */
+    }
+
     return success(reply, {
       ...settings,
       custom_fields,
       supplier_field_order,
+      available_vat_rates,
+      available_currencies,
       has_logo,
+      has_logo_dark,
+      app_version: pkg.version,
     });
   });
 
+  // GET /api/admin/company-settings/system-info
+  fastify.get(
+    "/system-info",
+    { preHandler: requirePermission("settings.manage") },
+    async (request, reply) => {
+      // eslint-disable-next-line @typescript-eslint/no-var-requires
+      const pkg = require("../../../package.json") as { version: string };
+      const uptimeSec = process.uptime();
+      const days = Math.floor(uptimeSec / 86400);
+      const hours = Math.floor((uptimeSec % 86400) / 3600);
+      const mins = Math.floor((uptimeSec % 3600) / 60);
+      const uptimeStr =
+        days > 0
+          ? `${days}d ${hours}h ${mins}m`
+          : hours > 0
+            ? `${hours}h ${mins}m`
+            : `${mins}m`;
+
+      const mem = process.memoryUsage();
+      const totalMem = os.totalmem();
+      const freeMem = os.freemem();
+
+      // DB connection check
+      let dbStatus = "ok";
+      let migrationCount = 0;
+      try {
+        const result = await prisma.$queryRaw<[{ cnt: bigint }]>`
+          SELECT COUNT(*) as cnt FROM _prisma_migrations WHERE finished_at IS NOT NULL
+        `;
+        migrationCount = Number(result[0]?.cnt ?? 0);
+      } catch (err) {
+        dbStatus = "error";
+        request.log.error(err, "DB health check failed");
+      }
+
+      // NAS status
+      const projectNas = new NasFileManager();
+
+      return success(reply, {
+        app_version: pkg.version,
+        node_version: process.version,
+        platform: `${os.type()} ${os.release()}`,
+        uptime: uptimeStr,
+        environment: config.appEnv,
+        timezone:
+          process.env.TZ || Intl.DateTimeFormat().resolvedOptions().timeZone,
+        memory: {
+          rss: `${Math.round(mem.rss / 1024 / 1024)} MB`,
+          heap_used: `${Math.round(mem.heapUsed / 1024 / 1024)} MB`,
+          heap_total: `${Math.round(mem.heapTotal / 1024 / 1024)} MB`,
+          system_total: `${Math.round(totalMem / 1024 / 1024)} MB`,
+          system_free: `${Math.round(freeMem / 1024 / 1024)} MB`,
+        },
+        database: {
+          status: dbStatus,
+          migrations_applied: migrationCount,
+        },
+        nas: {
+          projects: {
+            configured: projectNas.isConfigured(),
+            path: config.nas.path || "—",
+          },
+          financials: {
+            configured: nasFinancialsManager.isConfigured(),
+            path: config.nas.financialsPath || "—",
+          },
+          offers: {
+            configured: nasOffersManager.isConfigured(),
+            path: config.nas.offersPath || "—",
+          },
+        },
+      });
+    },
+  );
+
   fastify.put(
     "/",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const parsed = parseBody(UpdateCompanySettingsSchema, request.body);
       if ("error" in parsed) return error(reply, parsed.error, 400);
@@ -207,6 +363,13 @@ export default async function companySettingsRoutes(
         "default_currency",
         "order_type_code",
         "invoice_type_code",
+        "invoice_alert_email",
+        "leave_notify_email",
+        "smtp_from",
+        "smtp_from_name",
+        "offer_number_pattern",
+        "order_number_pattern",
+        "invoice_number_pattern",
       ];
       const bodyRec = body as Record<string, unknown>;
       for (const f of strFields) {
@@ -216,6 +379,24 @@ export default async function companySettingsRoutes(
       if (body.default_vat_rate !== undefined)
         data.default_vat_rate = Number(body.default_vat_rate);
       if (body.require_2fa !== undefined) data.require_2fa = !!body.require_2fa;
+
+      const numFields = [
+        "break_threshold_hours",
+        "break_duration_short",
+        "break_duration_long",
+        "clock_rounding_minutes",
+        "max_login_attempts",
+        "lockout_minutes",
+        "max_requests_per_minute",
+      ] as const;
+      for (const f of numFields) {
+        if (bodyRec[f] !== undefined) data[f] = Number(bodyRec[f]);
+      }
+
+      if (body.available_vat_rates !== undefined)
+        data.available_vat_rates = JSON.stringify(body.available_vat_rates);
+      if (body.available_currencies !== undefined)
+        data.available_currencies = JSON.stringify(body.available_currencies);
       if (
         body.custom_fields !== undefined ||
         body.supplier_field_order !== undefined
@@ -247,6 +428,8 @@ export default async function companySettingsRoutes(
         data,
       });
 
+      invalidateSettingsCache();
+
       await logAudit({
         request,
         authData: request.authData,

src/routes/admin/dashboard.ts

@@ -3,6 +3,7 @@ import prisma from "../../config/database";
 import { requireAuth } from "../../middleware/auth";
 import { success } from "../../utils/response";
 import { localTimeStr } from "../../utils/date";
+import { toCzk } from "../../services/exchange-rates";
 
 export default async function dashboardRoutes(
   fastify: FastifyInstance,
@@ -141,8 +142,8 @@ export default async function dashboardRoutes(
       const [openCount, convertedCount, expiredCount, createdThisMonth] =
         await Promise.all([
           prisma.quotations.count({ where: { status: "active" } }),
-          prisma.quotations.count({ where: { status: "converted" } }),
-          prisma.quotations.count({ where: { status: "expired" } }),
+          prisma.quotations.count({ where: { status: "ordered" } }),
+          prisma.quotations.count({ where: { status: "invalidated" } }),
           prisma.quotations.count({
             where: { created_at: { gte: monthStart, lt: monthEnd } },
           }),
@@ -206,10 +207,13 @@ export default async function dashboardRoutes(
           }),
         ),
         unpaid_count: unpaidCount,
-        revenue_czk:
-          revenueByCurrency["CZK"] != null
-            ? Math.round(revenueByCurrency["CZK"] * 100) / 100
-            : null,
+        revenue_czk: await (async () => {
+          let total = 0;
+          for (const [cur, amount] of Object.entries(revenueByCurrency)) {
+            total += await toCzk(Math.round(amount * 100) / 100, cur);
+          }
+          return Math.round(total * 100) / 100;
+        })(),
       };
       result.unpaid_invoices = unpaidCount;
     }

src/routes/admin/invoices-pdf.ts

@@ -5,6 +5,8 @@ import { requirePermission } from "../../middleware/auth";
 import { localDateCzStr } from "../../utils/date";
 import { nasFinancialsManager } from "../../services/nas-financials-manager";
 import { htmlToPdf } from "../../utils/html-to-pdf";
+import { getRate } from "../../services/exchange-rates";
+import { localDateStr } from "../../utils/date";
 
 /* ── Helpers ─────────────────────────────────────────────────────── */
 
@@ -282,6 +284,7 @@ export default async function invoicesPdfRoutes(
       > | null;
 
       let orderNumber = "";
+      let orderDate = "";
       if (invoice.order_id) {
         const orderRow = await prisma.orders.findUnique({
           where: { id: invoice.order_id },
@@ -297,6 +300,9 @@ export default async function invoicesPdfRoutes(
               orderRow.customer_order_number || orderRow.order_number || "",
             ),
           );
+          if (orderRow.created_at) {
+            orderDate = formatDate(orderRow.created_at);
+          }
         }
       }
 
@@ -358,9 +364,12 @@ export default async function invoicesPdfRoutes(
         // QR generation failed — leave empty
       }
 
-      // VAT recapitulation (always in CZK)
+      // VAT recapitulation (always in CZK — Czech tax requirement)
       const isForeign = currency.toUpperCase() !== "CZK";
-      const cnbRate = 1.0; // Skip CNB rate conversion
+      const issueDateStr = invoice.issue_date
+        ? localDateStr(new Date(invoice.issue_date))
+        : undefined;
+      const cnbRate = isForeign ? await getRate(currency, issueDateStr) : 1.0;
       const vatRates = [21, 12, 0];
       const vatRecap: Array<{
         rate: number;
@@ -422,7 +431,7 @@ export default async function invoicesPdfRoutes(
           return `<tr>
             <td class="row-num">${i + 1}</td>
             <td class="desc">${escapeHtml(item.description)}</td>
-            <td class="center">${formatNum(qty, qtyDecimals)}</td>
+            <td class="center">${formatNum(qty, qtyDecimals)}${item.unit ? ` / ${escapeHtml(item.unit)}` : ""}</td>
             <td class="right">${formatNum(unitPrice)}</td>
             <td class="right">${formatNum(lineSubtotal)}</td>
             <td class="center">${applyVat ? Math.floor(vatRate) : 0}%</td>
@@ -486,14 +495,14 @@ export default async function invoicesPdfRoutes(
 <style>
   @page {
     size: A4;
-    margin: 12mm 15mm 15mm 15mm;
+    margin: 8mm 12mm 10mm 12mm;
   }
   * { margin: 0; padding: 0; box-sizing: border-box; }
   html, body {
     font-family: "Segoe UI", Tahoma, Arial, sans-serif;
-    font-size: 9pt;
+    font-size: 10pt;
     color: #1a1a1a;
-    width: 180mm;
+    width: 186mm;
   }
 
   .invoice-page {
@@ -504,82 +513,35 @@ export default async function invoicesPdfRoutes(
   .invoice-content { flex: 1 1 auto; }
   .invoice-footer {
     flex-shrink: 0;
-    page-break-inside: avoid;
-    break-inside: avoid;
   }
 
   .accent { color: #de3a3a; }
 
-  /* Hlavicka */
+  /* ── Hlavicka ── */
   .invoice-header {
     display: flex;
     justify-content: space-between;
-    align-items: flex-start;
-    margin-bottom: 0;
+    align-items: center;
+    margin-bottom: 1mm;
     padding-bottom: 1mm;
+    border-bottom: 2pt solid #de3a3a;
   }
   .invoice-header .left {
     display: flex;
-    align-items: flex-start;
+    align-items: center;
     gap: 3mm;
   }
-  .logo-header {
-    text-align: left;
-  }
+  .logo-header { text-align: left; }
   .company-title {
     font-size: 12pt;
     font-weight: 700;
-    margin-top: 2mm;
   }
   .invoice-title {
-    font-size: 10pt;
+    font-size: 13pt;
     font-weight: 700;
     color: #de3a3a;
     text-align: right;
-    margin-top: 2mm;
-  }
-
-  /* Adresy - dva sloupce, stejna vyska */
-  .addresses-row {
-    display: flex;
-    gap: 8mm;
-    align-items: stretch;
-    margin-bottom: 0;
-  }
-  .addresses-row .address-block {
-    flex: 1;
-    padding-bottom: 2mm;
-    border-bottom: 0.5pt solid #e0e0e0;
-  }
-
-  /* Detaily pod adresami */
-  .details-row {
-    display: flex;
-    gap: 8mm;
-    margin-bottom: 3mm;
-  }
-  .details-row .col { flex: 1; }
-
-  /* Adresy - styl z nabidek */
-  .address-block {
-    margin-bottom: 0;
-  }
-  .address-label {
-    font-size: 8pt;
-    font-weight: 600;
-    color: #646464;
-    line-height: 1.5;
-  }
-  .address-name {
-    font-size: 9pt;
-    font-weight: 700;
-    color: #1a1a1a;
-    line-height: 1.5;
-  }
-  .address-line {
-    font-size: 8.5pt;
-    color: #1a1a1a;
-    line-height: 1.5;
+    letter-spacing: 0.03em;
   }
 
   .logo {
@@ -588,74 +550,87 @@ export default async function invoicesPdfRoutes(
     object-fit: contain;
   }
 
-  /* Separator */
-  .header-separator {
-    border: none;
-    border-top: 0.5pt solid #e0e0e0;
-    margin: 2mm 0 3mm 0;
+  /* ── Adresy ── */
+  .header-grid {
+    border: 0.5pt solid #d0d0d0;
+    border-collapse: collapse;
+    width: 100%;
+    margin-bottom: 1mm;
   }
-
-  /* Banka */
-  .bank-box {
+  .header-grid td {
+    padding: 2mm 3mm;
+    border: 0.5pt solid #d0d0d0;
+    vertical-align: top;
+    width: 50%;
+  }
+  .header-grid td.addr-customer {
+    background: #f5f5f5;
+  }
+  .header-grid td.details-bank {
+    background: #f5f5f5;
+  }
+  .address-label {
     font-size: 8pt;
-    line-height: 1.4;
-    padding-top: 2mm;
+    font-weight: 700;
+    color: #de3a3a;
+    text-transform: uppercase;
+    letter-spacing: 0.08em;
+    margin-bottom: 1mm;
   }
-  .bank-box .lbl {
-    font-weight: 600;
+  .address-name {
+    font-size: 10pt;
+    font-weight: 700;
     color: #1a1a1a;
-    display: inline-block;
-    min-width: 16mm;
+    line-height: 1.3;
+    margin-bottom: 1mm;
+  }
+  .address-line {
+    font-size: 9pt;
+    color: #444;
+    line-height: 1.5;
   }
 
-  /* Datumy */
-  .dates-box {
-    font-size: 8pt;
-    line-height: 1.4;
-    padding-top: 2mm;
-  }
-  .dates-row {
+  /* ── Detaily (banka + datumy) — inside header-grid ── */
+
+  .info-row {
     display: flex;
-    align-items: center;
-    margin-bottom: 0.5mm;
+    align-items: baseline;
+    font-size: 9pt;
+    padding: 1mm 0;
+    border-bottom: 0.5pt solid #f0f0f0;
   }
-  .dates-row .lbl {
-    flex: 1;
-    color: #1a1a1a;
+  .info-row:last-child { border-bottom: none; }
+  .info-row .lbl {
+    color: #666;
+    font-weight: 400;
+    flex-shrink: 0;
+    white-space: nowrap;
+    margin-right: 3mm;
   }
-  .dates-row .val {
+  .info-row .val {
     font-weight: 600;
-    min-width: 22mm;
-    text-align: center;
-    padding: 0.5mm 2mm;
+    color: #1a1a1a;
+    text-align: right;
+    margin-left: auto;
   }
 
   /* VS/KS blok */
   .vs-block {
-    font-size: 8pt;
+    font-size: 9pt;
     line-height: 1.4;
     padding-top: 2mm;
   }
 
-  /* Konecny prijemce */
-  .recipient-box {
-    font-size: 8pt;
-    margin-top: 2mm;
-    padding-top: 2mm;
-    border-top: 0.5pt solid #e0e0e0;
-  }
-  .recipient-box .lbl {
-    font-weight: 600;
-    font-style: italic;
-    color: #646464;
-  }
-
-  /* Polozky tabulka - styl z nabidek */
+  /* ── Polozky ── */
   .billing-label {
-    font-weight: 600;
-    color: #de3a3a;
-    font-size: 8.5pt;
-    padding: 3px 5px;
+    font-weight: 700;
+    color: #1a1a1a;
+    font-size: 10pt;
+    padding: 2mm 0 1mm 0;
+    border-bottom: 1.5pt solid #de3a3a;
+    margin-bottom: 0;
+    text-transform: uppercase;
+    letter-spacing: 0.03em;
   }
 
   table.items {
@@ -666,20 +641,18 @@ export default async function invoicesPdfRoutes(
     margin-bottom: 2mm;
   }
   table.items thead th {
-    font-size: 8pt;
+    font-size: 8.5pt;
     font-weight: 600;
     color: #646464;
-    padding: 6px 8px;
+    padding: 4px 4px;
     text-align: left;
-    letter-spacing: 0.02em;
-    text-transform: uppercase;
-    border-bottom: 1pt solid #1a1a1a;
+    border-bottom: 0.5pt solid #d0d0d0;
     white-space: nowrap;
   }
   table.items thead th.center { text-align: center; }
   table.items thead th.right { text-align: right; }
   table.items tbody td {
-    padding: 5px 8px;
+    padding: 4px 4px;
     border-bottom: 0.5pt solid #e0e0e0;
     vertical-align: middle;
     color: #1a1a1a;
@@ -690,11 +663,11 @@ export default async function invoicesPdfRoutes(
   table.items tbody td.row-num {
     text-align: center;
     color: #969696;
-    font-size: 8pt;
+    font-size: 9pt;
   }
   table.items tbody td.desc {
-    font-size: 9.5pt;
-    font-weight: 500;
+    font-size: 9pt;
+    font-weight: 600;
     color: #1a1a1a;
   }
   table.items tbody td.total-cell { font-weight: 700; }
@@ -715,7 +688,7 @@ export default async function invoicesPdfRoutes(
     display: flex;
     justify-content: space-between;
     align-items: baseline;
-    font-size: 8.5pt;
+    font-size: 9.5pt;
     color: #1a1a1a;
     margin-bottom: 2mm;
   }
@@ -727,7 +700,7 @@ export default async function invoicesPdfRoutes(
     align-items: baseline;
   }
   .totals .grand .label {
-    font-size: 9.5pt;
+    font-size: 10.5pt;
     font-weight: 400;
     color: #1a1a1a;
     align-self: center;
@@ -741,14 +714,14 @@ export default async function invoicesPdfRoutes(
   }
   .totals .currency-note {
     text-align: right;
-    font-size: 7.5pt;
+    font-size: 8pt;
     color: #1a1a1a;
     margin-top: 2mm;
   }
 
   /* Vystavil */
   .issued-by {
-    font-size: 8pt;
+    font-size: 9pt;
     margin: 2mm 0;
     line-height: 1.4;
   }
@@ -756,7 +729,7 @@ export default async function invoicesPdfRoutes(
 
   /* Upozorneni */
   .notice {
-    font-size: 7pt;
+    font-size: 8pt;
     color: #1a1a1a;
     margin: 2mm 0;
     line-height: 1.3;
@@ -778,11 +751,11 @@ export default async function invoicesPdfRoutes(
 
   .recap-section table {
     border-collapse: collapse;
-    font-size: 8pt;
+    font-size: 9pt;
     flex: 1;
   }
   .recap-section table th {
-    font-size: 7.5pt;
+    font-size: 8pt;
     font-weight: 600;
     color: #555;
     padding: 3px 6px;
@@ -796,7 +769,7 @@ export default async function invoicesPdfRoutes(
   }
   .recap-section table td.center { text-align: center; }
   .recap-section table td.cnb-rate {
-    font-size: 7pt;
+    font-size: 8pt;
     color: #888;
     text-align: right;
     border-bottom: none;
@@ -806,13 +779,14 @@ export default async function invoicesPdfRoutes(
   /* Prevzal / razitko */
   .footer-row {
     display: flex;
+    justify-content: space-between;
     margin-top: 4mm;
-    font-size: 8pt;
-  }
-  .footer-row .col {
-    flex: 1;
+    font-size: 9pt;
     border-top: 0.5pt solid #aaa;
     padding-top: 2mm;
+    min-height: 15mm;
+  }
+  .footer-row .col {
     font-weight: 600;
     color: #555;
   }
@@ -820,13 +794,13 @@ export default async function invoicesPdfRoutes(
   /* Poznamky */
   .invoice-notes {
     margin-top: 4mm;
-    font-size: 9pt;
+    font-size: 10pt;
     line-height: 1.5;
     color: #1a1a1a;
   }
   .invoice-notes-label {
     font-weight: 600;
-    font-size: 8pt;
+    font-size: 9pt;
     text-transform: uppercase;
     color: #555;
     margin-bottom: 1mm;
@@ -834,20 +808,18 @@ export default async function invoicesPdfRoutes(
   .invoice-notes-content p { margin: 0 0 0.4em 0; }
   .invoice-notes-content ul, .invoice-notes-content ol { margin: 0 0 0.4em 1.5em; }
   .invoice-notes-content li { margin-bottom: 0.2em; }
+  .invoice-notes-content,
+  .invoice-notes-content * {
+    font-family: Tahoma, sans-serif !important;
+  }
+  .invoice-notes-content { font-size: 14px; }
+  .invoice-notes-content h1 { font-size: 20px; }
+  .invoice-notes-content h2 { font-size: 18px; }
+  .invoice-notes-content h3 { font-size: 16px; }
+  .invoice-notes-content h4 { font-size: 15px; }
 
-  /* Quill fonty */
-  .ql-font-arial            { font-family: Arial, sans-serif; }
-  .ql-font-tahoma           { font-family: Tahoma, sans-serif; }
-  .ql-font-verdana          { font-family: Verdana, sans-serif; }
-  .ql-font-georgia          { font-family: Georgia, serif; }
-  .ql-font-times-new-roman  { font-family: "Times New Roman", serif; }
-  .ql-font-courier-new      { font-family: "Courier New", monospace; }
-  .ql-font-trebuchet-ms     { font-family: "Trebuchet MS", sans-serif; }
-  .ql-font-impact           { font-family: Impact, sans-serif; }
-  .ql-font-comic-sans-ms    { font-family: "Comic Sans MS", cursive; }
-  .ql-font-lucida-console   { font-family: "Lucida Console", monospace; }
-  .ql-font-palatino-linotype{ font-family: "Palatino Linotype", serif; }
-  .ql-font-garamond         { font-family: Garamond, serif; }
+  /* Quill fonty – v PDF vynuceno Tahoma */
+  [class*="ql-font-"] { font-family: Tahoma, sans-serif !important; }
   .ql-align-center  { text-align: center; }
   .ql-align-right   { text-align: right; }
   .ql-align-justify { text-align: justify; }
@@ -893,59 +865,54 @@ ${indentCSS}
     <div class="invoice-title">${escapeHtml(t.heading)} ${invoiceNumber}</div>
   </div>
 
-  <hr class="header-separator" />
-
-  <!-- Dodavatel / Odberatel - stejna vyska -->
-  <div class="addresses-row">
-    <div class="address-block">
-      <div class="address-label">${escapeHtml(t.supplier)}</div>
-      <div class="address-name">${escapeHtml(supp.name)}</div>
-      ${suppLinesHtml}
-    </div>
-    <div class="address-block">
-      <div class="address-label">${escapeHtml(t.customer)}</div>
-      <div class="address-name">${escapeHtml(cust.name)}</div>
-      ${custLinesHtml}
-    </div>
-  </div>
-
-  <!-- Banka + VS / Datumy -->
-  <div class="details-row">
-    <div class="col">
-      <div class="bank-box">
-        <span class="lbl">${escapeHtml(t.bank)}</span> ${escapeHtml(invoice.bank_name)}<br>
-        <span class="lbl">${escapeHtml(t.swift)}</span> ${escapeHtml(invoice.bank_swift)}<br>
-        <span class="lbl">${escapeHtml(t.iban)}</span> ${escapeHtml(invoice.bank_iban)}<br>
-        <span class="lbl">${escapeHtml(t.account_no)}</span> ${escapeHtml(invoice.bank_account)}
-      </div>
-      <div class="vs-block">
-        ${escapeHtml(t.var_symbol)} <strong>${invoiceNumber}</strong>
-        &nbsp;&nbsp;&nbsp; ${escapeHtml(t.const_symbol)} <strong>${escapeHtml(invoice.constant_symbol)}</strong><br>
-        ${orderNumber ? `${escapeHtml(t.order_no)} ${orderNumber}` : ""}
-      </div>
-    </div>
-    <div class="col">
-      <div class="dates-box">
-        <div class="dates-row"><span class="lbl">${escapeHtml(t.issue_date)}</span> <span class="val">${escapeHtml(formatDate(invoice.issue_date))}</span></div>
-        <div class="dates-row"><span class="lbl">${escapeHtml(t.due_date)}</span> <span class="val">${escapeHtml(formatDate(invoice.due_date))}</span></div>
-        <div class="dates-row"><span class="lbl">${escapeHtml(t.tax_date)}</span> <span class="val">${escapeHtml(formatDate(invoice.tax_date))}</span></div>
-        <div class="dates-row"><span class="lbl">${escapeHtml(t.payment_method)}</span> <span class="val">${escapeHtml(invoice.payment_method)}</span></div>
-      </div>
-    </div>
-  </div>
+  <!-- Dodavatel / Odberatel + Banka / Datumy -->
+  <table class="header-grid" cellspacing="0">
+    <tr>
+      <td>
+        <div class="address-label">${escapeHtml(t.supplier)}</div>
+        <div class="address-name">${escapeHtml(supp.name)}</div>
+        ${suppLinesHtml}
+      </td>
+      <td class="addr-customer">
+        <div class="address-label">${escapeHtml(t.customer)}</div>
+        <div class="address-name">${escapeHtml(cust.name)}</div>
+        ${custLinesHtml}
+      </td>
+    </tr>
+    <tr>
+      <td class="details-bank">
+        <div class="info-row"><span class="lbl">${escapeHtml(t.bank)}</span> <span class="val">${escapeHtml(invoice.bank_name)}</span></div>
+        <div class="info-row"><span class="lbl">${escapeHtml(t.swift)}</span> <span class="val">${escapeHtml(invoice.bank_swift)}</span></div>
+        <div class="info-row"><span class="lbl">${escapeHtml(t.iban)}</span> <span class="val">${escapeHtml(invoice.bank_iban)}</span></div>
+        <div class="info-row"><span class="lbl">${escapeHtml(t.account_no)}</span> <span class="val">${escapeHtml(invoice.bank_account)}</span></div>
+        <div class="vs-block">
+          ${escapeHtml(t.var_symbol)} <strong>${invoiceNumber}</strong>
+          &nbsp;&nbsp;&nbsp; ${escapeHtml(t.const_symbol)} <strong>${escapeHtml(invoice.constant_symbol)}</strong>
+        </div>
+      </td>
+      <td>
+        <div class="info-row"><span class="lbl">${escapeHtml(t.issue_date)}</span> <span class="val">${escapeHtml(formatDate(invoice.issue_date))}</span></div>
+        <div class="info-row"><span class="lbl">${escapeHtml(t.due_date)}</span> <span class="val">${escapeHtml(formatDate(invoice.due_date))}</span></div>
+        <div class="info-row"><span class="lbl">${escapeHtml(t.tax_date)}</span> <span class="val">${escapeHtml(formatDate(invoice.tax_date))}</span></div>
+        <div class="info-row"><span class="lbl">${escapeHtml(t.payment_method)}</span> <span class="val">${escapeHtml(invoice.payment_method)}</span></div>
+        ${orderNumber ? `<div class="info-row"><span class="lbl">${lang === "cs" ? "Objednávka č.:" : "Order no.:"}</span> <span class="val">${orderNumber}</span></div>` : ""}
+        ${orderDate ? `<div class="info-row"><span class="lbl">${lang === "cs" ? "Objednávka ze dne:" : "Order date:"}</span> <span class="val">${escapeHtml(orderDate)}</span></div>` : ""}
+      </td>
+    </tr>
+  </table>
 
   <!-- Polozky -->
   <div class="billing-label">${escapeHtml(invoice.billing_text || t.billing)}</div>
   <table class="items">
     <thead>
       <tr>
-        <th class="center" style="width:5%">${escapeHtml(t.col_no)}</th>
-        <th style="width:30%">${escapeHtml(t.col_desc)}</th>
-        <th class="center" style="width:9%">${escapeHtml(t.col_qty)}</th>
-        <th class="right" style="width:11%">${escapeHtml(t.col_unit_price)}</th>
-        <th class="right" style="width:11%">${escapeHtml(t.col_price)}</th>
-        <th class="center" style="width:7%">${escapeHtml(t.col_vat_pct)}</th>
-        <th class="right" style="width:11%">${escapeHtml(t.col_vat)}</th>
+        <th class="center" style="width:3%">${escapeHtml(t.col_no)}</th>
+        <th style="width:36%">${escapeHtml(t.col_desc)}</th>
+        <th class="center" style="width:10%">${escapeHtml(t.col_qty)}</th>
+        <th class="right" style="width:10%">${escapeHtml(t.col_unit_price)}</th>
+        <th class="right" style="width:10%">${escapeHtml(t.col_price)}</th>
+        <th class="center" style="width:5%">${escapeHtml(t.col_vat_pct)}</th>
+        <th class="right" style="width:10%">${escapeHtml(t.col_vat)}</th>
         <th class="right" style="width:16%">${escapeHtml(t.col_total)}</th>
       </tr>
     </thead>
@@ -1007,6 +974,17 @@ ${indentCSS}
       <tbody>
         ${vatRecapHtml}
       </tbody>
+      ${
+        isForeign
+          ? `<tfoot>
+        <tr>
+          <td colspan="4" style="font-size:0.7em; color:#666; padding-top:6px; text-align:left;">
+            Přepočet kurzem ČNB ke dni ${formatDate(invoice.issue_date)}: 1 ${escapeHtml(currency)} = ${cnbRate.toFixed(3).replace(".", ",")} CZK
+          </td>
+        </tr>
+      </tfoot>`
+          : ""
+      }
     </table>
   </div>
 
@@ -1028,6 +1006,7 @@ ${indentCSS}
           ? new Date(invoice.issue_date)
           : new Date();
         const saveMode = query.save === "1";
+        nasFinancialsManager.cleanIssuedInvoice(invoice.invoice_number!);
         const pdfPromise = htmlToPdf(html)
           .then((pdfBuffer) => {
             nasFinancialsManager.saveIssuedInvoicePdf(

src/routes/admin/invoices.ts

@@ -13,6 +13,7 @@ import {
   markOverdueInvoices,
   listInvoices,
   getNextInvoiceNumberFormatted,
+  getNextInvoiceNumberPreview,
   getInvoiceStats,
   getOrderDataForInvoice,
   getInvoice,
@@ -65,7 +66,7 @@ export default async function invoicesRoutes(
     "/next-number",
     { preHandler: requirePermission("invoices.create") },
     async (_request, reply) => {
-      const result = await getNextInvoiceNumberFormatted();
+      const result = await getNextInvoiceNumberPreview();
       return success(reply, result);
     },
   );

src/routes/admin/leave-requests.ts

@@ -29,7 +29,7 @@ export default async function leaveRequestsRoutes(
     const isAdmin = authData.permissions.includes("attendance.approve");
 
     const where: Record<string, unknown> = {};
-    if (!isAdmin) where.user_id = authData.userId;
+    if (!isAdmin || query.mine === "1") where.user_id = authData.userId;
     else if (query.user_id) where.user_id = Number(query.user_id);
     if (query.status) where.status = String(query.status);
 

src/routes/admin/offers-pdf.ts

@@ -381,19 +381,8 @@ export default async function offersPdfRoutes(
 
   img, table, pre, code { max-width: 100%; }
 
-  /* ---- Quill font classes ---- */
-  .ql-font-arial            { font-family: Arial, sans-serif; }
-  .ql-font-tahoma           { font-family: Tahoma, sans-serif; }
-  .ql-font-verdana          { font-family: Verdana, sans-serif; }
-  .ql-font-georgia          { font-family: Georgia, serif; }
-  .ql-font-times-new-roman  { font-family: "Times New Roman", serif; }
-  .ql-font-courier-new      { font-family: "Courier New", monospace; }
-  .ql-font-trebuchet-ms     { font-family: "Trebuchet MS", sans-serif; }
-  .ql-font-impact           { font-family: Impact, sans-serif; }
-  .ql-font-comic-sans-ms    { font-family: "Comic Sans MS", cursive; }
-  .ql-font-lucida-console   { font-family: "Lucida Console", monospace; }
-  .ql-font-palatino-linotype{ font-family: "Palatino Linotype", serif; }
-  .ql-font-garamond         { font-family: Garamond, serif; }
+  /* ---- Quill font classes – v PDF vynuceno Tahoma ---- */
+  [class*="ql-font-"] { font-family: Tahoma, sans-serif !important; }
 
   /* ---- Quill alignment ---- */
   .ql-align-center  { text-align: center; }
@@ -517,7 +506,7 @@ ${indentCSS}
   }
   table.items tbody td.desc {
     font-size: 10pt;
-    font-weight: 500;
+    font-weight: 600;
     color: #1a1a1a;
   }
   table.items tbody td.total-cell {
@@ -606,6 +595,15 @@ ${indentCSS}
     word-break: normal;
     overflow-wrap: anywhere;
   }
+  .section-content,
+  .section-content * {
+    font-family: Tahoma, sans-serif !important;
+  }
+  .section-content { font-size: 14px; }
+  .section-content h1 { font-size: 20px; }
+  .section-content h2 { font-size: 18px; }
+  .section-content h3 { font-size: 16px; }
+  .section-content h4 { font-size: 15px; }
   .section-content p { margin: 0 0 0.4em 0; }
   .section-content ul, .section-content ol { margin: 0 0 0.4em 1.5em; }
   .section-content li { margin-bottom: 0.2em; }

src/routes/admin/orders-pdf.ts

@@ -0,0 +1,858 @@
+import { FastifyInstance } from "fastify";
+import prisma from "../../config/database";
+import { requirePermission } from "../../middleware/auth";
+import { localDateCzStr } from "../../utils/date";
+import { htmlToPdf } from "../../utils/html-to-pdf";
+
+/* ── Helpers ─────────────────────────────────────────────────────── */
+
+function formatDate(date: Date | string | null | undefined): string {
+  if (!date) return "";
+  const d = new Date(date);
+  if (isNaN(d.getTime())) return String(date);
+  return localDateCzStr(d);
+}
+
+function formatNum(n: number, decimals = 2): string {
+  const abs = Math.abs(n);
+  const fixed = abs.toFixed(decimals);
+  const [intPart, decPart] = fixed.split(".");
+  const withSep = intPart.replace(/\B(?=(\d{3})+(?!\d))/g, " ");
+  const result = decPart ? `${withSep},${decPart}` : withSep;
+  return n < 0 ? `-${result}` : result;
+}
+
+function escapeHtml(str: string | null | undefined): string {
+  if (!str) return "";
+  return str
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}
+
+function cleanQuillHtml(html: string | null | undefined): string {
+  if (!html) return "";
+  let s = html;
+  s = s.replace(
+    /<(script|iframe|object|embed|style|link|meta|base|form|input|textarea|button|select|svg|math)[^>]*>[\s\S]*?<\/\1>/gi,
+    "",
+  );
+  s = s.replace(
+    /<(script|iframe|object|embed|style|link|meta|base|form|input|textarea|button|select|svg|math)[^>]*\/?>/gi,
+    "",
+  );
+  s = s.replace(/\s+on\w+\s*=\s*("[^"]*"|'[^']*'|[^\s>]*)/gi, "");
+  s = s.replace(/\s+on\w+\s*=\s*[^\s>]*/gi, "");
+  s = s.replace(/href\s*=\s*["']?\s*javascript\s*:[^"'>\s]*/gi, 'href="#"');
+  s = s.replace(/(&nbsp;)/g, " ");
+  let prev = "";
+  while (prev !== s) {
+    prev = s;
+    s = s.replace(/<span([^>]*)>(.*?)<\/span>\s*<span\1>/gs, "<span$1>$2");
+  }
+  return s;
+}
+
+interface AddressResult {
+  name: string;
+  lines: string[];
+}
+
+function buildAddressLines(
+  entity: Record<string, unknown> | null,
+  isSupplier: boolean,
+  tObj: Record<string, string>,
+): AddressResult {
+  if (!entity) return { name: "", lines: [] };
+
+  const nameKey = isSupplier ? "company_name" : "name";
+  const name = String(entity[nameKey] || "");
+
+  let cfData: Array<{ name?: string; value?: string; showLabel?: boolean }> =
+    [];
+  let fieldOrder: string[] | null = null;
+  const raw = entity.custom_fields;
+  if (raw) {
+    const parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
+    if (parsed && typeof parsed === "object") {
+      if ((parsed as Record<string, unknown>).fields) {
+        cfData =
+          ((parsed as Record<string, unknown>).fields as typeof cfData) || [];
+        fieldOrder = ((parsed as Record<string, unknown>).field_order ||
+          (parsed as Record<string, unknown>).fieldOrder) as string[] | null;
+      } else if (Array.isArray(parsed)) {
+        cfData = parsed;
+      }
+    }
+  }
+
+  if (Array.isArray(fieldOrder)) {
+    const legacyMap: Record<string, string> = {
+      Name: "name",
+      CompanyName: "company_name",
+      Street: "street",
+      CityPostal: "city_postal",
+      Country: "country",
+      CompanyId: "company_id",
+      VatId: "vat_id",
+    };
+    fieldOrder = fieldOrder.map((k) => legacyMap[k] || k);
+  }
+
+  const fieldMap: Record<string, string> = {};
+  if (name) fieldMap[nameKey] = name;
+  if (entity.street) fieldMap.street = String(entity.street);
+  const cityParts = [entity.city || "", entity.postal_code || ""]
+    .filter(Boolean)
+    .map(String);
+  const cityPostal = cityParts.join(" ").trim();
+  if (cityPostal) fieldMap.city_postal = cityPostal;
+  if (entity.country) fieldMap.country = String(entity.country);
+  if (entity.company_id)
+    fieldMap.company_id = `${tObj.ico}${entity.company_id}`;
+  if (entity.vat_id) fieldMap.vat_id = `${tObj.dic}${entity.vat_id}`;
+
+  cfData.forEach((cf, i) => {
+    const cfName = (cf.name || "").trim();
+    const cfValue = (cf.value || "").trim();
+    const showLabel = cf.showLabel !== false;
+    if (cfValue) {
+      fieldMap[`custom_${i}`] =
+        showLabel && cfName ? `${cfName}: ${cfValue}` : cfValue;
+    }
+  });
+
+  const lines: string[] = [];
+  if (Array.isArray(fieldOrder) && fieldOrder.length) {
+    for (const key of fieldOrder) {
+      if (key === nameKey) continue;
+      if (fieldMap[key]) lines.push(fieldMap[key]);
+    }
+    for (const [key, line] of Object.entries(fieldMap)) {
+      if (key === nameKey) continue;
+      if (!fieldOrder!.includes(key)) lines.push(line);
+    }
+  } else {
+    for (const [key, line] of Object.entries(fieldMap)) {
+      if (key === nameKey) continue;
+      lines.push(line);
+    }
+  }
+
+  return { name, lines };
+}
+
+/* ── Translations ────────────────────────────────────────────────── */
+
+const translations: Record<string, Record<string, string>> = {
+  cs: {
+    title: "POTVRZENÍ PŘIJETÍ OBJEDNÁVKY",
+    supplier: "Dodavatel",
+    customer: "Odběratel",
+    order_no: "Číslo objednávky:",
+    po_no: "Číslo zakáz. objednávky:",
+    date: "Datum:",
+    payment_method: "Forma úhrady:",
+    billing: "Potvrzujeme Vám následující položky:",
+    col_no: "Č.",
+    col_desc: "Popis",
+    col_qty: "Množství",
+    col_unit_price: "Jedn. cena",
+    col_price: "Cena",
+    col_vat_pct: "%DPH",
+    col_vat: "DPH",
+    col_total: "Celkem",
+    subtotal: "Mezisoučet:",
+    vat_label: "DPH",
+    total: "Celkem",
+    amounts_in: "Částky jsou uvedeny v",
+    notes: "Poznámky",
+    issued_by: "Vystavil:",
+    received_by: "Převzal:",
+    stamp: "Razítko:",
+    ico: "IČ: ",
+    dic: "DIČ: ",
+  },
+  en: {
+    title: "ORDER CONFIRMATION",
+    supplier: "Supplier",
+    customer: "Customer",
+    order_no: "Order No.:",
+    po_no: "PO No.:",
+    date: "Date:",
+    payment_method: "Payment method:",
+    billing: "We confirm the following items:",
+    col_no: "No.",
+    col_desc: "Description",
+    col_qty: "Quantity",
+    col_unit_price: "Unit price",
+    col_price: "Price",
+    col_vat_pct: "VAT%",
+    col_vat: "VAT",
+    col_total: "Total",
+    subtotal: "Subtotal:",
+    vat_label: "VAT",
+    total: "Total",
+    amounts_in: "Amounts are in",
+    notes: "Notes",
+    issued_by: "Issued by:",
+    received_by: "Received by:",
+    stamp: "Stamp:",
+    ico: "Reg. No.: ",
+    dic: "Tax ID: ",
+  },
+};
+
+/* ── Route ───────────────────────────────────────────────────────── */
+
+export default async function ordersPdfRoutes(
+  fastify: FastifyInstance,
+): Promise<void> {
+  fastify.post<{ Params: { id: string }; Body: Record<string, unknown> }>(
+    "/:id/confirmation",
+    { preHandler: requirePermission("orders.view") },
+    async (request, reply) => {
+      const id = parseInt(request.params.id, 10);
+      const body = request.body || {};
+      const lang = body.lang === "en" ? "en" : "cs";
+      const t = translations[lang];
+
+      const order = await prisma.orders.findUnique({
+        where: { id },
+        include: {
+          customers: true,
+          order_items: { orderBy: { position: "asc" } },
+        },
+      });
+
+      if (!order) {
+        return reply
+          .status(404)
+          .type("text/html")
+          .send("<html><body><h1>Objednávka nenalezena</h1></body></html>");
+      }
+
+      const settings = (await prisma.company_settings.findFirst()) as Record<
+        string,
+        unknown
+      > | null;
+
+      let logoImg = "";
+      if (settings?.logo_data) {
+        const buf = Buffer.from(settings.logo_data as Buffer);
+        let mime = "image/png";
+        if (buf[0] === 0xff && buf[1] === 0xd8) mime = "image/jpeg";
+        else if (buf[0] === 0x47 && buf[1] === 0x49) mime = "image/gif";
+        else if (buf[0] === 0x52 && buf[1] === 0x49) mime = "image/webp";
+        const b64 = buf.toString("base64");
+        logoImg = `<img src="data:${escapeHtml(mime)};base64,${b64}" class="logo" />`;
+      }
+
+      const currency = order.currency || "CZK";
+      const applyVat =
+        body.applyVat !== undefined ? !!body.applyVat : !!order.apply_vat;
+      const orderVatRate = Number(order.vat_rate) || 21;
+
+      // Use custom items from body if provided, otherwise order items
+      const customItemsRaw = body.items;
+      let items: Array<{
+        description: string;
+        quantity: number;
+        unit: string;
+        unit_price: number;
+        is_included_in_total: boolean;
+        vat_rate: number;
+      }> = [];
+
+      if (Array.isArray(customItemsRaw) && customItemsRaw.length > 0) {
+        items = customItemsRaw.map((it: Record<string, unknown>) => ({
+          description: String(it.description || ""),
+          quantity: Number(it.quantity) || 0,
+          unit: String(it.unit || ""),
+          unit_price: Number(it.unit_price) || 0,
+          is_included_in_total:
+            it.is_included_in_total !== false && it.is_included_in_total !== 0,
+          vat_rate: Number(it.vat_rate) || orderVatRate,
+        }));
+      } else {
+        items = order.order_items.map((it) => ({
+          description: it.description || "",
+          quantity: Number(it.quantity) || 0,
+          unit: it.unit || "",
+          unit_price: Number(it.unit_price) || 0,
+          is_included_in_total: !!it.is_included_in_total,
+          vat_rate: orderVatRate,
+        }));
+      }
+
+      let subtotal = 0;
+      let totalVat = 0;
+      const vatSummary: Record<string, { base: number; vat: number }> = {};
+      for (const item of items) {
+        if (item.is_included_in_total) {
+          const lineTotal = item.quantity * item.unit_price;
+          subtotal += lineTotal;
+          const rate = item.vat_rate;
+          const key = String(rate);
+          if (!vatSummary[key]) vatSummary[key] = { base: 0, vat: 0 };
+          vatSummary[key].base += lineTotal;
+          if (applyVat) {
+            const lineVat = (lineTotal * rate) / 100;
+            vatSummary[key].vat += lineVat;
+            totalVat += lineVat;
+          }
+        }
+      }
+      const totalToPay = subtotal + totalVat;
+
+      const userName = request.authData
+        ? `${request.authData.firstName || ""} ${request.authData.lastName || ""}`.trim()
+        : "";
+
+      const supp = buildAddressLines(settings, true, t);
+      const cust = buildAddressLines(
+        (order.customers as Record<string, unknown>) || null,
+        false,
+        t,
+      );
+
+      const suppLinesHtml = supp.lines
+        .map((l) => `<div class="address-line">${escapeHtml(l)}</div>`)
+        .join("");
+      const custLinesHtml = cust.lines
+        .map((l) => `<div class="address-line">${escapeHtml(l)}</div>`)
+        .join("");
+
+      const orderNumber = escapeHtml(order.order_number || "");
+      const poNumber = escapeHtml(order.customer_order_number || "");
+      const orderDateStr = formatDate(order.created_at);
+
+      const itemsHtml = items
+        .map((item, i) => {
+          const lineSubtotal = item.quantity * item.unit_price;
+          const lineVat = applyVat ? (lineSubtotal * item.vat_rate) / 100 : 0;
+          const lineTotal = lineSubtotal + lineVat;
+          const qtyDecimals =
+            Math.floor(item.quantity) === item.quantity ? 0 : 2;
+          return `<tr>
+            <td class="row-num">${i + 1}</td>
+            <td class="desc">${escapeHtml(item.description)}</td>
+            <td class="center">${formatNum(item.quantity, qtyDecimals)}${item.unit ? ` / ${escapeHtml(item.unit)}` : ""}</td>
+            <td class="right">${formatNum(item.unit_price)}</td>
+            <td class="right">${formatNum(lineSubtotal)}</td>
+            <td class="center">${applyVat ? Math.floor(item.vat_rate) : 0}%</td>
+            <td class="right">${formatNum(lineVat)}</td>
+            <td class="right total-cell">${formatNum(lineTotal)}</td>
+        </tr>`;
+        })
+        .join("");
+
+      const paymentMethod = lang === "cs" ? "převodem" : "Bank transfer";
+
+      let vatDetailHtml = "";
+      if (applyVat) {
+        for (const [rate, data] of Object.entries(vatSummary)) {
+          if (data.vat > 0) {
+            vatDetailHtml += `
+        <div class="row">
+          <span class="label">${escapeHtml(t.vat_label)} ${Math.floor(Number(rate))}%:</span>
+          <span class="value">${formatNum(data.vat)} ${escapeHtml(currency)}</span>
+        </div>`;
+          }
+        }
+      }
+
+      const notesRaw = order.notes ?? "";
+      const notesStripped = notesRaw.replace(/<[^>]*>/g, "").trim();
+      const notesHtml = notesStripped
+        ? `
+  <div class="invoice-notes">
+    <div class="invoice-notes-label">${escapeHtml(t.notes)}</div>
+    <div class="invoice-notes-content">${cleanQuillHtml(notesRaw)}</div>
+  </div>
+  `
+        : "";
+
+      // Quill indent CSS
+      let indentCSS = "";
+      for (let n = 1; n <= 9; n++) {
+        const pad = n * 3;
+        const liPad = n * 3 + 1.5;
+        indentCSS += `  .ql-indent-${n} { padding-left: ${pad}em; }\n`;
+        indentCSS += `  li.ql-indent-${n} { padding-left: ${liPad}em; }\n`;
+      }
+
+      const html = `<!DOCTYPE html>
+<html lang="${escapeHtml(lang)}">
+<head>
+<meta charset="utf-8" />
+<title>${escapeHtml(t.title)} ${orderNumber}</title>
+<style>
+  @page {
+    size: A4;
+    margin: 8mm 12mm 10mm 12mm;
+  }
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  html, body {
+    font-family: "Segoe UI", Tahoma, Arial, sans-serif;
+    font-size: 10pt;
+    color: #1a1a1a;
+    width: 186mm;
+  }
+
+  .invoice-page {
+    display: flex;
+    flex-direction: column;
+    min-height: calc(297mm - 27mm);
+  }
+  .invoice-content { flex: 1 1 auto; }
+  .invoice-footer {
+    flex-shrink: 0;
+  }
+
+  .accent { color: #de3a3a; }
+
+  /* ── Hlavicka ── */
+  .invoice-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-bottom: 1mm;
+    padding-bottom: 1mm;
+    border-bottom: 2pt solid #de3a3a;
+  }
+  .invoice-header .left {
+    display: flex;
+    align-items: center;
+    gap: 3mm;
+  }
+  .logo-header { text-align: left; }
+  .company-title {
+    font-size: 12pt;
+    font-weight: 700;
+  }
+  .invoice-title {
+    font-size: 13pt;
+    font-weight: 700;
+    color: #de3a3a;
+    text-align: right;
+    letter-spacing: 0.03em;
+  }
+
+  .logo {
+    max-width: 42mm;
+    max-height: 22mm;
+    object-fit: contain;
+  }
+
+  /* ── Adresy ── */
+  .header-grid {
+    border: 0.5pt solid #d0d0d0;
+    border-collapse: collapse;
+    width: 100%;
+    margin-bottom: 1mm;
+  }
+  .header-grid td {
+    padding: 2mm 3mm;
+    border: 0.5pt solid #d0d0d0;
+    vertical-align: top;
+    width: 50%;
+  }
+  .header-grid td.addr-customer {
+    background: #f5f5f5;
+  }
+  .header-grid td.details-bank {
+    background: #f5f5f5;
+  }
+  .address-label {
+    font-size: 8pt;
+    font-weight: 700;
+    color: #de3a3a;
+    text-transform: uppercase;
+    letter-spacing: 0.08em;
+    margin-bottom: 1mm;
+  }
+  .address-name {
+    font-size: 10pt;
+    font-weight: 700;
+    color: #1a1a1a;
+    line-height: 1.3;
+    margin-bottom: 1mm;
+  }
+  .address-line {
+    font-size: 9pt;
+    color: #444;
+    line-height: 1.5;
+  }
+
+  /* ── Detaily (banka + datumy) — inside header-grid ── */
+
+  .info-row {
+    display: flex;
+    align-items: baseline;
+    font-size: 9pt;
+    padding: 1mm 0;
+    border-bottom: 0.5pt solid #f0f0f0;
+  }
+  .info-row:last-child { border-bottom: none; }
+  .info-row .lbl {
+    color: #666;
+    font-weight: 400;
+    flex-shrink: 0;
+    white-space: nowrap;
+    margin-right: 3mm;
+  }
+  .info-row .val {
+    font-weight: 600;
+    color: #1a1a1a;
+    text-align: right;
+    margin-left: auto;
+  }
+
+  /* VS/KS blok */
+  .vs-block {
+    font-size: 9pt;
+    line-height: 1.4;
+    padding-top: 2mm;
+  }
+
+  /* ── Polozky ── */
+  .billing-label {
+    font-weight: 700;
+    color: #1a1a1a;
+    font-size: 10pt;
+    padding: 2mm 0 1mm 0;
+    border-bottom: 1.5pt solid #de3a3a;
+    margin-bottom: 0;
+    text-transform: uppercase;
+    letter-spacing: 0.03em;
+  }
+
+  table.items {
+    width: 100%;
+    table-layout: fixed;
+    border-collapse: collapse;
+    font-size: 9pt;
+    margin-bottom: 2mm;
+  }
+  table.items thead th {
+    font-size: 8.5pt;
+    font-weight: 600;
+    color: #646464;
+    padding: 4px 4px;
+    text-align: left;
+    border-bottom: 0.5pt solid #d0d0d0;
+    white-space: nowrap;
+  }
+  table.items thead th.center { text-align: center; }
+  table.items thead th.right { text-align: right; }
+  table.items tbody td {
+    padding: 4px 4px;
+    border-bottom: 0.5pt solid #e0e0e0;
+    vertical-align: middle;
+    color: #1a1a1a;
+  }
+  table.items tbody tr:nth-child(even) { background: #f8f9fa; }
+  table.items tbody td.center { text-align: center; white-space: nowrap; }
+  table.items tbody td.right { text-align: right; }
+  table.items tbody td.row-num {
+    text-align: center;
+    color: #969696;
+    font-size: 9pt;
+  }
+  table.items tbody td.desc {
+    font-size: 9pt;
+    font-weight: 600;
+    color: #1a1a1a;
+  }
+  table.items tbody td.total-cell { font-weight: 700; }
+
+  /* Soucet + total - styl z nabidek */
+  .totals-wrapper {
+    display: flex;
+    justify-content: flex-end;
+    margin-top: 2mm;
+  }
+  .totals {
+    width: 80mm;
+  }
+  .totals .detail-rows {
+    margin-bottom: 3mm;
+  }
+  .totals .row {
+    display: flex;
+    justify-content: space-between;
+    align-items: baseline;
+    font-size: 9.5pt;
+    color: #1a1a1a;
+    margin-bottom: 2mm;
+  }
+  .totals .grand {
+    border-top: 0.5pt solid #e0e0e0;
+    padding-top: 4mm;
+    display: flex;
+    justify-content: space-between;
+    align-items: baseline;
+  }
+  .totals .grand .label {
+    font-size: 10.5pt;
+    font-weight: 400;
+    color: #1a1a1a;
+    align-self: center;
+  }
+  .totals .grand .value {
+    font-size: 14pt;
+    font-weight: 600;
+    color: #1a1a1a;
+    border-bottom: 2.5pt solid #de3a3a;
+    padding-bottom: 1mm;
+  }
+  .totals .currency-note {
+    text-align: right;
+    font-size: 8pt;
+    color: #1a1a1a;
+    margin-top: 2mm;
+  }
+
+  /* Vystavil */
+  .issued-by {
+    font-size: 9pt;
+    margin: 2mm 0;
+    line-height: 1.4;
+  }
+  .issued-by .lbl { font-weight: 600; }
+
+  /* Upozorneni */
+  .notice {
+    font-size: 8pt;
+    color: #1a1a1a;
+    margin: 2mm 0;
+    line-height: 1.3;
+  }
+
+  /* DPH rekapitulace + QR */
+  .recap-section {
+    display: flex;
+    gap: 5mm;
+    align-items: flex-start;
+    margin-top: 1mm;
+  }
+  .recap-section .qr {
+    flex-shrink: 0;
+    width: 28mm;
+  }
+  .recap-section .qr img,
+  .recap-section .qr svg { width: 28mm; height: 28mm; }
+
+  .recap-section table {
+    border-collapse: collapse;
+    font-size: 9pt;
+    flex: 1;
+  }
+  .recap-section table th {
+    font-size: 8pt;
+    font-weight: 600;
+    color: #555;
+    padding: 3px 6px;
+    text-align: right;
+    border-bottom: 0.5pt solid #ccc;
+  }
+  .recap-section table td {
+    padding: 3px 6px;
+    text-align: right;
+    border-bottom: 0.5pt solid #eee;
+  }
+  .recap-section table td.center { text-align: center; }
+  .recap-section table td.cnb-rate {
+    font-size: 8pt;
+    color: #888;
+    text-align: right;
+    border-bottom: none;
+    padding-top: 4px;
+  }
+
+  /* Prevzal / razitko */
+  .footer-row {
+    display: flex;
+    justify-content: space-between;
+    margin-top: 4mm;
+    font-size: 9pt;
+    border-top: 0.5pt solid #aaa;
+    padding-top: 2mm;
+    min-height: 15mm;
+  }
+  .footer-row .col {
+    font-weight: 600;
+    color: #555;
+  }
+
+  /* Poznamky */
+  .invoice-notes {
+    margin-top: 4mm;
+    font-size: 10pt;
+    line-height: 1.5;
+    color: #1a1a1a;
+  }
+  .invoice-notes-label {
+    font-weight: 600;
+    font-size: 9pt;
+    text-transform: uppercase;
+    color: #555;
+    margin-bottom: 1mm;
+  }
+  .invoice-notes-content p { margin: 0 0 0.4em 0; }
+  .invoice-notes-content ul, .invoice-notes-content ol { margin: 0 0 0.4em 1.5em; }
+  .invoice-notes-content li { margin-bottom: 0.2em; }
+  .invoice-notes-content,
+  .invoice-notes-content * {
+    font-family: Tahoma, sans-serif !important;
+  }
+  .invoice-notes-content { font-size: 14px; }
+  .invoice-notes-content h1 { font-size: 20px; }
+  .invoice-notes-content h2 { font-size: 18px; }
+  .invoice-notes-content h3 { font-size: 16px; }
+  .invoice-notes-content h4 { font-size: 15px; }
+
+  /* Quill fonty – v PDF vynuceno Tahoma */
+  [class*="ql-font-"] { font-family: Tahoma, sans-serif !important; }
+  .ql-align-center  { text-align: center; }
+  .ql-align-right   { text-align: right; }
+  .ql-align-justify { text-align: justify; }
+${indentCSS}
+
+  @media print {
+    body { -webkit-print-color-adjust: exact; print-color-adjust: exact; }
+  }
+  @media screen {
+    html { background: #525659; }
+    body {
+      width: 100vw !important;
+      margin: 0;
+      padding: 30px 0;
+      background: transparent;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      min-height: 100vh;
+      overflow-x: hidden;
+    }
+    .invoice-page {
+      width: 210mm;
+      min-height: 297mm;
+      padding: 15mm;
+      background: white;
+      box-shadow: 0 4px 20px rgba(0,0,0,0.3);
+      box-sizing: border-box;
+      border-radius: 2px;
+    }
+  }
+</style>
+</head>
+<body>
+<div class="invoice-page">
+<div class="invoice-content">
+
+  <!-- Hlavicka -->
+  <div class="invoice-header">
+    <div class="left">
+      ${logoImg ? `<div class="logo-header">${logoImg}</div>` : ""}
+    </div>
+    <div class="invoice-title">${escapeHtml(t.title)}</div>
+  </div>
+
+  <!-- Dodavatel / Odberatel + Detaily -->
+  <table class="header-grid" cellspacing="0">
+    <tr>
+      <td>
+        <div class="address-label">${escapeHtml(t.supplier)}</div>
+        <div class="address-name">${escapeHtml(supp.name)}</div>
+        ${suppLinesHtml}
+      </td>
+      <td class="addr-customer">
+        <div class="address-label">${escapeHtml(t.customer)}</div>
+        <div class="address-name">${escapeHtml(cust.name)}</div>
+        ${custLinesHtml}
+      </td>
+    </tr>
+    <tr>
+      <td class="details-bank">
+        <div class="info-row"><span class="lbl">${escapeHtml(t.order_no)}</span> <span class="val">${orderNumber}</span></div>
+        ${poNumber ? `<div class="info-row"><span class="lbl">${escapeHtml(t.po_no)}</span> <span class="val">${poNumber}</span></div>` : ""}
+        <div class="info-row"><span class="lbl">${escapeHtml(t.payment_method)}</span> <span class="val">${escapeHtml(paymentMethod)}</span></div>
+      </td>
+      <td>
+        <div class="info-row"><span class="lbl">${escapeHtml(t.date)}</span> <span class="val">${escapeHtml(orderDateStr)}</span></div>
+      </td>
+    </tr>
+  </table>
+
+  <!-- Polozky -->
+  <div class="billing-label">${escapeHtml(t.billing)}</div>
+  <table class="items">
+    <thead>
+      <tr>
+        <th class="center" style="width:3%">${escapeHtml(t.col_no)}</th>
+        <th style="width:36%">${escapeHtml(t.col_desc)}</th>
+        <th class="center" style="width:10%">${escapeHtml(t.col_qty)}</th>
+        <th class="right" style="width:10%">${escapeHtml(t.col_unit_price)}</th>
+        <th class="right" style="width:10%">${escapeHtml(t.col_price)}</th>
+        <th class="center" style="width:5%">${escapeHtml(t.col_vat_pct)}</th>
+        <th class="right" style="width:10%">${escapeHtml(t.col_vat)}</th>
+        <th class="right" style="width:16%">${escapeHtml(t.col_total)}</th>
+      </tr>
+    </thead>
+    <tbody>
+      ${itemsHtml}
+    </tbody>
+  </table>
+
+  <!-- Soucty -->
+  <div class="totals-wrapper">
+    <div class="totals">
+      <div class="detail-rows">
+        <div class="row">
+          <span class="label">${escapeHtml(t.subtotal)}</span>
+          <span class="value">${formatNum(subtotal)} ${escapeHtml(currency)}</span>
+        </div>${vatDetailHtml}
+      </div>
+      <div class="grand">
+        <span class="label">${escapeHtml(t.total)}</span>
+        <span class="value">${formatNum(totalToPay)} ${escapeHtml(currency)}</span>
+      </div>
+      <div class="currency-note">${escapeHtml(t.amounts_in)} ${escapeHtml(currency)}</div>
+    </div>
+  </div>
+
+  ${notesHtml}
+
+</div><!-- /.invoice-content -->
+<div class="invoice-footer">
+
+  <!-- Vystavil -->
+  <div class="issued-by">
+    <span class="lbl">${escapeHtml(t.issued_by)}</span> ${escapeHtml(userName)}
+  </div>
+
+  <!-- Prevzal / razitko -->
+  <div class="footer-row">
+    <div class="col">${escapeHtml(t.received_by)}</div>
+    <div class="col" style="text-align:right">${escapeHtml(t.stamp)}</div>
+  </div>
+
+</div><!-- /.invoice-footer -->
+</div><!-- /.invoice-page -->
+
+</body>
+</html>`;
+
+      const pdfBuffer = await htmlToPdf(html);
+      const filename = `Potvrzeni-${orderNumber || String(id)}.pdf`;
+
+      return reply
+        .type("application/pdf")
+        .header("Content-Disposition", `attachment; filename="${filename}"`)
+        .send(pdfBuffer);
+    },
+  );
+}

src/routes/admin/projects.ts

@@ -91,8 +91,11 @@ export default async function projectsRoutes(
       const parsed = parseBody(UpdateProjectSchema, request.body);
       if ("error" in parsed) return error(reply, parsed.error, 400);
 
-      const existing = await updateProject(id, parsed.data);
-      if (!existing) return error(reply, "Projekt nenalezen", 404);
+      const result = await updateProject(id, parsed.data);
+      if (!result) return error(reply, "Projekt nenalezen", 404);
+      if ("error" in result) {
+        return error(reply, result.error, (result as any).status ?? 400);
+      }
 
       await logAudit({
         request,
@@ -100,7 +103,7 @@ export default async function projectsRoutes(
         action: "update",
         entityType: "project",
         entityId: id,
-        description: `Upraven projekt ${existing.name}`,
+        description: `Upraven projekt ${result.name}`,
       });
       return success(reply, { id }, 200, "Projekt byl uložen");
     },

src/routes/admin/quotations.ts

@@ -278,7 +278,11 @@ export default async function quotationsRoutes(
           return error(reply, "Nabídka nenalezena", 404);
         if (result.error === "invalidated")
           return error(reply, "Nelze upravit zneplatněnou nabídku", 400);
-        return error(reply, "Neznámá chyba", 500);
+        return error(
+          reply,
+          result.error || "Neznámá chyba",
+          (result as any).status ?? 400,
+        );
       }
 
       // Keep lock — user stays on the page after save

src/routes/admin/received-invoices.ts

@@ -12,8 +12,14 @@ import {
   UpdateReceivedInvoiceSchema,
 } from "../../schemas/received-invoices.schema";
 import { nasFinancialsManager } from "../../services/nas-financials-manager";
+import { toCzk } from "../../services/exchange-rates";
 
 const VALID_STATUSES = ["unpaid", "paid"] as const;
+
+/** Round a monetary value to 2 decimal places to avoid floating-point drift. */
+function roundMoney(n: number): number {
+  return Math.round(n * 100) / 100;
+}
 const ALLOWED_SORT_FIELDS = [
   "id",
   "supplier_name",
@@ -108,12 +114,15 @@ export default async function receivedInvoicesRoutes(
           }));
       };
 
-      const sumCzk = (
+      const sumCzk = async (
         invs: typeof monthInvoices,
         field: "amount" | "vat_amount",
       ) => {
         let total = 0;
-        for (const inv of invs) total += Number(inv[field]) || 0;
+        for (const inv of invs) {
+          const amount = Number(inv[field]) || 0;
+          total += await toCzk(amount, inv.currency);
+        }
         return Math.round(total * 100) / 100;
       };
 
@@ -124,11 +133,11 @@ export default async function receivedInvoicesRoutes(
 
       return success(reply, {
         total_month: aggregateByCurrency(monthInvoices, "amount"),
-        total_month_czk: sumCzk(monthInvoices, "amount"),
+        total_month_czk: await sumCzk(monthInvoices, "amount"),
         vat_month: aggregateByCurrency(monthInvoices, "vat_amount"),
-        vat_month_czk: sumCzk(monthInvoices, "vat_amount"),
+        vat_month_czk: await sumCzk(monthInvoices, "vat_amount"),
         unpaid: aggregateByCurrency(allUnpaid, "amount"),
-        unpaid_czk: sumCzk(allUnpaid, "amount"),
+        unpaid_czk: await sumCzk(allUnpaid, "amount"),
         unpaid_count: allUnpaid.length,
         month_count: monthInvoices.length,
       });
@@ -236,7 +245,7 @@ export default async function receivedInvoicesRoutes(
             try {
               invoicesMeta = JSON.parse(part.value as string);
             } catch {
-              /* ignore parse error */
+              // Malformed invoices metadata — ignore, use defaults
             }
           }
         }
@@ -407,6 +416,15 @@ export default async function receivedInvoicesRoutes(
         }
       }
 
+      if (String(existing.status) === "paid") {
+        const attempted = Object.keys(body).filter(
+          (k) => !["status", "paid_date", "notes"].includes(k),
+        );
+        if (attempted.length > 0) {
+          return error(reply, "Nelze upravit uhrazenou fakturu", 400);
+        }
+      }
+
       // Recalculate vat_amount when amount or vat_rate changes (matching PHP)
       const finalAmount =
         body.amount !== undefined
@@ -419,9 +437,9 @@ export default async function receivedInvoicesRoutes(
       // Amount includes VAT — extract VAT portion: amount - amount/(1 + rate/100)
       const computedVat =
         finalVatRate > 0
-          ? Math.round(
-              (finalAmount - finalAmount / (1 + finalVatRate / 100)) * 100,
-            ) / 100
+          ? roundMoney(
+              finalAmount - roundMoney(finalAmount / (1 + finalVatRate / 100)),
+            )
           : 0;
 
       // Auto-set paid_date when status transitions to paid (matching PHP)

src/routes/admin/roles.ts

@@ -12,7 +12,7 @@ export default async function rolesRoutes(
   // GET /api/admin/roles
   fastify.get(
     "/",
-    { preHandler: requirePermission("settings.roles") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const roles = await prisma.roles.findMany({
         include: {
@@ -35,7 +35,7 @@ export default async function rolesRoutes(
   // GET /api/admin/roles/permissions
   fastify.get(
     "/permissions",
-    { preHandler: requirePermission("settings.roles") },
+    { preHandler: requirePermission("settings.manage") },
     async (_request, reply) => {
       const permissions = await prisma.permissions.findMany({
         orderBy: { module: "asc" },
@@ -47,7 +47,7 @@ export default async function rolesRoutes(
   // POST /api/admin/roles
   fastify.post(
     "/",
-    { preHandler: requirePermission("settings.roles") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const parsed = parseBody(CreateRoleSchema, request.body);
       if ("error" in parsed) return error(reply, parsed.error, 400);
@@ -86,7 +86,7 @@ export default async function rolesRoutes(
   // PUT /api/admin/roles/:id
   fastify.put<{ Params: { id: string } }>(
     "/:id",
-    { preHandler: requirePermission("settings.roles") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const id = parseId(request.params.id, reply);
       if (id === null) return;
@@ -136,7 +136,7 @@ export default async function rolesRoutes(
   // DELETE /api/admin/roles/:id
   fastify.delete<{ Params: { id: string } }>(
     "/:id",
-    { preHandler: requirePermission("settings.roles") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const id = parseId(request.params.id, reply);
       if (id === null) return;

src/routes/admin/scope-templates.ts

@@ -22,7 +22,7 @@ export default async function scopeTemplatesRoutes(
   // Legacy ?action= dispatcher for item templates
   fastify.get(
     "/",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const query = request.query as Record<string, unknown>;
       const action = query.action ? String(query.action) : null;
@@ -53,7 +53,7 @@ export default async function scopeTemplatesRoutes(
   // Item template CRUD via ?action=item
   fastify.post(
     "/",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const query = request.query as Record<string, unknown>;
 
@@ -121,7 +121,7 @@ export default async function scopeTemplatesRoutes(
   // Item template delete via DELETE ?action=item&id=X
   fastify.delete(
     "/",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const query = request.query as Record<string, unknown>;
 
@@ -140,7 +140,7 @@ export default async function scopeTemplatesRoutes(
 
   fastify.get<{ Params: { id: string } }>(
     "/:id",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const id = parseId(request.params.id, reply);
       if (id === null) return;
@@ -161,7 +161,7 @@ export default async function scopeTemplatesRoutes(
 
   fastify.put<{ Params: { id: string } }>(
     "/:id",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const id = parseId(request.params.id, reply);
       if (id === null) return;
@@ -208,7 +208,7 @@ export default async function scopeTemplatesRoutes(
 
   fastify.delete<{ Params: { id: string } }>(
     "/:id",
-    { preHandler: requirePermission("offers.settings") },
+    { preHandler: requirePermission("settings.manage") },
     async (request, reply) => {
       const id = parseId(request.params.id, reply);
       if (id === null) return;

src/routes/admin/totp.ts

@@ -5,6 +5,7 @@ import prisma from "../../config/database";
 import { requireAuth, requirePermission } from "../../middleware/auth";
 import { success, error } from "../../utils/response";
 import { encrypt } from "../../utils/encryption";
+import { getSystemSettings } from "../../services/system-settings";
 import { OTPAuth } from "../../utils/totp";
 import * as OTPAuthLib from "otpauth";
 import { logAudit } from "../../services/audit";
@@ -16,9 +17,18 @@ export default async function totpRoutes(
 ): Promise<void> {
   // GET - generate new TOTP secret
   fastify.get("/setup", { preHandler: requireAuth }, async (request, reply) => {
+    const settings = await getSystemSettings();
+    const companyName =
+      (
+        await prisma.company_settings.findFirst({
+          select: { company_name: true },
+        })
+      )?.company_name ||
+      settings.smtp_from_name ||
+      "System";
     const secret = new OTPAuthLib.Secret();
     const totp = new OTPAuthLib.TOTP({
-      issuer: "BOHA Automation",
+      issuer: companyName,
       label: request.authData!.email,
       secret,
       algorithm: "SHA1",
@@ -153,7 +163,7 @@ export default async function totpRoutes(
   // GET - check if 2FA is required company-wide
   fastify.get(
     "/required",
-    { preHandler: [requireAuth, requirePermission("settings.security")] },
+    { preHandler: [requireAuth, requirePermission("settings.manage")] },
     async (request, reply) => {
       const settings = await prisma.company_settings.findFirst({
         select: { require_2fa: true },
@@ -167,7 +177,7 @@ export default async function totpRoutes(
   fastify.post(
     "/required",
     {
-      preHandler: [requireAuth, requirePermission("settings.security")],
+      preHandler: [requireAuth, requirePermission("settings.manage")],
       bodyLimit: 10240,
     },
     async (request, reply) => {

src/routes/admin/trips.ts

@@ -66,6 +66,45 @@ export default async function tripsRoutes(
     });
   });
 
+  // GET /api/admin/trips/users — users with trips.record permission
+  fastify.get(
+    "/users",
+    { preHandler: requireAuth },
+    async (_request, reply) => {
+      const users = await prisma.users.findMany({
+        where: {
+          is_active: true,
+          roles: {
+            is: {
+              OR: [
+                { name: "admin" },
+                {
+                  role_permissions: {
+                    some: { permissions: { name: "trips.record" } },
+                  },
+                },
+              ],
+            },
+          },
+        },
+        select: {
+          id: true,
+          first_name: true,
+          last_name: true,
+          username: true,
+        },
+        orderBy: { last_name: "asc" },
+      });
+      return success(
+        reply,
+        users.map((u) => ({
+          id: u.id,
+          name: `${u.first_name} ${u.last_name}`.trim() || u.username,
+        })),
+      );
+    },
+  );
+
   // GET /api/admin/trips/print — print data for trip report
   fastify.get(
     "/print",

src/schemas/attendance.schema.ts

@@ -39,7 +39,9 @@ export const AttendanceBalancesSchema = z.object({
 
 export const AttendanceBulkSchema = z.object({
   month: z.string().regex(/^\d{4}-\d{2}$/, "Měsíc je povinný (formát YYYY-MM)"),
-  user_ids: z.array(z.number()).min(1, "Vyberte alespoň jednoho zaměstnance"),
+  user_ids: z
+    .array(z.union([z.number(), z.string()]).transform((v) => Number(v)))
+    .min(1, "Vyberte alespoň jednoho zaměstnance"),
   arrival_time: z.string().optional().default("08:00"),
   departure_time: z.string().optional().default("16:30"),
   break_start_time: z.string().optional().default("12:00"),

src/schemas/company-settings.schema.ts

@@ -1,28 +0,0 @@
-import { z } from "zod";
-
-export const UpdateCompanySettingsSchema = z.object({
-  company_name: z.string().nullish(),
-  street: z.string().nullish(),
-  city: z.string().nullish(),
-  postal_code: z.string().nullish(),
-  country: z.string().nullish(),
-  company_id: z.string().nullish(),
-  vat_id: z.string().nullish(),
-  quotation_prefix: z.string().nullish(),
-  default_currency: z.string().nullish(),
-  order_type_code: z.string().nullish(),
-  invoice_type_code: z.string().nullish(),
-  default_vat_rate: z
-    .union([z.number(), z.string()])
-    .transform((v) => Number(v))
-    .optional(),
-  require_2fa: z
-    .preprocess((v) => v === true || v === 1 || v === "1", z.boolean())
-    .optional(),
-  custom_fields: z.array(z.any()).optional(),
-  supplier_field_order: z.array(z.any()).optional(),
-});
-
-export type UpdateCompanySettingsInput = z.infer<
-  typeof UpdateCompanySettingsSchema
->;

src/schemas/offers.schema.ts

@@ -66,7 +66,6 @@ export const CreateQuotationSchema = z.object({
 });
 
 export const UpdateQuotationSchema = z.object({
-  quotation_number: z.string().optional(),
   project_code: z.string().nullish(),
   customer_id: z
     .union([z.number(), z.string()])

src/schemas/orders.schema.ts

@@ -75,7 +75,6 @@ export const CreateOrderSchema = z.object({
 });
 
 export const UpdateOrderSchema = z.object({
-  order_number: z.string().nullish(),
   customer_order_number: z.string().nullish(),
   status: z.string().optional(),
   currency: z.string().optional(),

src/schemas/projects.schema.ts

@@ -1,7 +1,12 @@
 import { z } from "zod";
 
+const safeProjectNumber = z
+  .string()
+  .regex(/^[\p{L}\p{N}_\-.]+$/u, "Číslo projektu obsahuje nepovolené znaky")
+  .nullish();
+
 export const CreateProjectSchema = z.object({
-  project_number: z.string().nullish(),
+  project_number: safeProjectNumber,
   name: z.string().nullish(),
   customer_id: z
     .union([z.number(), z.string()])
@@ -26,7 +31,6 @@ export const CreateProjectSchema = z.object({
 });
 
 export const UpdateProjectSchema = z.object({
-  project_number: z.string().nullish(),
   name: z.string().nullish(),
   status: z.string().optional(),
   notes: z.string().nullish(),

src/schemas/settings.schema.ts

@@ -0,0 +1,65 @@
+import { z } from "zod";
+
+export const UpdateCompanySettingsSchema = z.object({
+  company_name: z.string().nullish(),
+  street: z.string().nullish(),
+  city: z.string().nullish(),
+  postal_code: z.string().nullish(),
+  country: z.string().nullish(),
+  company_id: z.string().nullish(),
+  vat_id: z.string().nullish(),
+  quotation_prefix: z.string().nullish(),
+  default_currency: z.string().nullish(),
+  order_type_code: z.string().nullish(),
+  invoice_type_code: z.string().nullish(),
+  default_vat_rate: z
+    .union([z.number(), z.string()])
+    .transform((v) => Number(v))
+    .optional(),
+  require_2fa: z
+    .preprocess((v) => v === true || v === 1 || v === "1", z.boolean())
+    .optional(),
+  break_threshold_hours: z
+    .union([z.number(), z.string()])
+    .transform((v) => Number(v))
+    .optional(),
+  break_duration_short: z
+    .union([z.number(), z.string()])
+    .transform((v) => Number(v))
+    .optional(),
+  break_duration_long: z
+    .union([z.number(), z.string()])
+    .transform((v) => Number(v))
+    .optional(),
+  clock_rounding_minutes: z
+    .union([z.number(), z.string()])
+    .transform((v) => Number(v))
+    .optional(),
+  invoice_alert_email: z.string().nullish(),
+  leave_notify_email: z.string().nullish(),
+  smtp_from: z.string().nullish(),
+  smtp_from_name: z.string().nullish(),
+  offer_number_pattern: z.string().nullish(),
+  order_number_pattern: z.string().nullish(),
+  invoice_number_pattern: z.string().nullish(),
+  max_login_attempts: z
+    .union([z.number(), z.string()])
+    .transform((v) => Number(v))
+    .optional(),
+  lockout_minutes: z
+    .union([z.number(), z.string()])
+    .transform((v) => Number(v))
+    .optional(),
+  max_requests_per_minute: z
+    .union([z.number(), z.string()])
+    .transform((v) => Number(v))
+    .optional(),
+  available_vat_rates: z.array(z.number()).optional(),
+  available_currencies: z.array(z.string()).optional(),
+  custom_fields: z.array(z.any()).optional(),
+  supplier_field_order: z.array(z.any()).optional(),
+});
+
+export type UpdateCompanySettingsInput = z.infer<
+  typeof UpdateCompanySettingsSchema
+>;

src/schemas/users.schema.ts

@@ -16,7 +16,10 @@ export const CreateUserSchema = z.object({
 export const UpdateUserSchema = z.object({
   username: z.string().optional(),
   email: z.string().email("Neplatný formát e-mailu").optional(),
-  password: z.string().min(8, "Heslo musí mít alespoň 8 znaků").optional(),
+  password: z.preprocess(
+    (v) => (v === "" ? undefined : v),
+    z.string().min(8, "Heslo musí mít alespoň 8 znaků").optional(),
+  ),
   first_name: z.string().optional(),
   last_name: z.string().optional(),
   role_id: z.union([z.number(), z.string(), z.null()]).optional(),

src/server.ts

@@ -29,13 +29,16 @@ import totpRoutes from "./routes/admin/totp";
 import scopeTemplatesRoutes from "./routes/admin/scope-templates";
 import invoicesPdfRoutes from "./routes/admin/invoices-pdf";
 import offersPdfRoutes from "./routes/admin/offers-pdf";
+import ordersPdfRoutes from "./routes/admin/orders-pdf";
 import projectFilesRoutes from "./routes/admin/project-files";
 
 const app = Fastify({
   logger: {
     level: config.isProduction ? "warn" : "info",
   },
-  trustProxy: true,
+  trustProxy: config.isProduction
+    ? ["127.0.0.1", "192.168.50.100"]
+    : ["127.0.0.1", "::1"],
   bodyLimit: 1048576,
 });
 
@@ -57,8 +60,14 @@ async function start() {
 
   await app.register(cookie);
 
+  // --- Health check (before rate-limit so monitoring isn't throttled) ---
+  app.get("/api/health", async () => ({
+    status: "ok",
+    timestamp: new Date().toISOString(),
+  }));
+
   await app.register(rateLimit, {
-    max: 100,
+    max: 300,
     timeWindow: "1 minute",
   });
 
@@ -116,16 +125,11 @@ async function start() {
   });
   await app.register(invoicesPdfRoutes, { prefix: "/api/admin/invoices-pdf" });
   await app.register(offersPdfRoutes, { prefix: "/api/admin/offers-pdf" });
+  await app.register(ordersPdfRoutes, { prefix: "/api/admin/orders-pdf" });
   await app.register(projectFilesRoutes, {
     prefix: "/api/admin/project-files",
   });
 
-  // --- Health check ---
-  app.get("/api/health", async () => ({
-    status: "ok",
-    timestamp: new Date().toISOString(),
-  }));
-
   // --- Frontend: Vite dev middleware (dev only) ---
   if (!config.isProduction) {
     const viteModule = await (Function(
@@ -189,14 +193,14 @@ async function start() {
         app.log.error(err, "Invoice alert cron failed");
       }
     });
-    console.log("Invoice alert cron scheduled (daily 8:00)");
+    app.log.info("Invoice alert cron scheduled (daily 8:00)");
   }
 
   // --- Start ---
   const port = config.isProduction ? config.port : 3000;
   try {
     await app.listen({ port, host: config.host });
-    console.log(`Server running on http://${config.host}:${port}`);
+    app.log.info(`Server running on http://${config.host}:${port}`);
   } catch (err) {
     app.log.error(err);
     process.exit(1);

src/services/attendance.service.ts

@@ -1,7 +1,31 @@
 import { attendance_leave_type, Prisma } from "@prisma/client";
 import prisma from "../config/database";
-import { getBusinessDaysInMonth } from "../utils/czech-holidays";
+import { getBusinessDaysInMonth, isHoliday } from "../utils/czech-holidays";
 import { localDateStr } from "../utils/date";
+import { getSystemSettings } from "./system-settings";
+
+/** Get active users whose role has attendance.record permission (or admin role) */
+async function getAttendanceUsers() {
+  return prisma.users.findMany({
+    where: {
+      is_active: true,
+      roles: {
+        is: {
+          OR: [
+            { name: "admin" },
+            {
+              role_permissions: {
+                some: { permissions: { name: "attendance.record" } },
+              },
+            },
+          ],
+        },
+      },
+    },
+    select: { id: true, first_name: true, last_name: true },
+    orderBy: { last_name: "asc" },
+  });
+}
 
 type AttendanceWithRelations = Prisma.attendanceGetPayload<{
   include: {
@@ -48,13 +72,13 @@ function calcWorkedHours(
   return Math.max(0, mins) / 60;
 }
 
-const roundUp15 = (d: Date) => {
-  const ms = 15 * 60 * 1000;
+const roundUp = (d: Date, minutes: number) => {
+  const ms = minutes * 60 * 1000;
   return new Date(Math.ceil(d.getTime() / ms) * ms);
 };
 
-const roundDown15 = (d: Date) => {
-  const ms = 15 * 60 * 1000;
+const roundDown = (d: Date, minutes: number) => {
+  const ms = minutes * 60 * 1000;
   return new Date(Math.floor(d.getTime() / ms) * ms);
 };
 
@@ -395,17 +419,32 @@ export async function switchProject(userId: number, projectId: number | null) {
 
   const now = new Date();
 
-  await prisma.attendance_project_logs.updateMany({
+  // End active project logs, ensuring ended_at is never before started_at
+  // (can happen when arrival_time was rounded up and now is still earlier)
+  const activeLogs = await prisma.attendance_project_logs.findMany({
     where: { attendance_id: ongoing.id, ended_at: null },
-    data: { ended_at: now },
   });
+  for (const log of activeLogs) {
+    const endedAt =
+      log.started_at && log.started_at > now ? log.started_at : now;
+    await prisma.attendance_project_logs.update({
+      where: { id: log.id },
+      data: { ended_at: endedAt },
+    });
+  }
 
   if (projectId) {
+    const existingLogs = await prisma.attendance_project_logs.count({
+      where: { attendance_id: ongoing.id },
+    });
+    const isFirstProject = existingLogs === 0;
+    let startedAt = isFirstProject ? ongoing.arrival_time! : now;
+    if (startedAt > now) startedAt = now;
     await prisma.attendance_project_logs.create({
       data: {
         attendance_id: ongoing.id,
         project_id: projectId,
-        started_at: now,
+        started_at: startedAt,
         ended_at: null,
       },
     });
@@ -420,11 +459,7 @@ export async function switchProject(userId: number, projectId: number | null) {
 }
 
 export async function getBalances(year: number) {
-  const users = await prisma.users.findMany({
-    where: { is_active: true },
-    select: { id: true, first_name: true, last_name: true },
-    orderBy: { last_name: "asc" },
-  });
+  const users = await getAttendanceUsers();
 
   const balances: Record<
     string,
@@ -462,11 +497,7 @@ export async function getBalances(year: number) {
 }
 
 export async function getWorkfund(year: number) {
-  const users = await prisma.users.findMany({
-    where: { is_active: true },
-    select: { id: true, first_name: true, last_name: true },
-    orderBy: { last_name: "asc" },
-  });
+  const users = await getAttendanceUsers();
 
   const now = new Date();
   const currentYear = now.getFullYear();
@@ -614,19 +645,28 @@ export async function getProjectReport(year: number) {
     },
     include: {
       users: { select: { id: true, first_name: true, last_name: true } },
+      attendance_project_logs: {
+        orderBy: { started_at: "asc" },
+      },
     },
   });
 
-  const projectIds = [
-    ...new Set(records.filter((r) => r.project_id).map((r) => r.project_id!)),
-  ];
+  // Collect all project ids from both attendance.project_id and project logs
+  const projectIds = new Set<number>();
+  for (const rec of records) {
+    if (rec.project_id) projectIds.add(rec.project_id);
+    for (const log of rec.attendance_project_logs) {
+      projectIds.add(log.project_id);
+    }
+  }
+
   const projectsMap = new Map<
     number,
     { name: string; project_number: string }
   >();
-  if (projectIds.length > 0) {
+  if (projectIds.size > 0) {
     const projects = await prisma.projects.findMany({
-      where: { id: { in: projectIds } },
+      where: { id: { in: [...projectIds] } },
       select: { id: true, name: true, project_number: true },
     });
     for (const p of projects) {
@@ -670,32 +710,68 @@ export async function getProjectReport(year: number) {
     >();
 
     for (const rec of monthRecs) {
-      const hours = calcWorkedHours(
-        rec.arrival_time!,
-        rec.departure_time!,
-        rec.break_start,
-        rec.break_end,
-      );
-      const pid = rec.project_id;
-
-      if (!projectMap.has(pid)) {
-        const projInfo = pid ? projectsMap.get(pid) : undefined;
-        projectMap.set(pid, {
-          project_number: projInfo?.project_number || undefined,
-          project_name: projInfo?.name || undefined,
-          userMap: new Map(),
-        });
-      }
-
-      const pg = projectMap.get(pid)!;
       const uid = rec.user_id;
       const uName = rec.users
         ? `${rec.users.first_name} ${rec.users.last_name}`.trim()
         : `User #${uid}`;
-      if (!pg.userMap.has(uid)) {
-        pg.userMap.set(uid, { name: uName, hours: 0 });
+
+      if (rec.attendance_project_logs.length === 0) {
+        // No detailed project logs — fall back to attendance.project_id
+        const pid = rec.project_id;
+        const hours = calcWorkedHours(
+          rec.arrival_time!,
+          rec.departure_time!,
+          rec.break_start,
+          rec.break_end,
+        );
+
+        if (!projectMap.has(pid)) {
+          const projInfo = pid ? projectsMap.get(pid) : undefined;
+          projectMap.set(pid, {
+            project_number: projInfo?.project_number || undefined,
+            project_name: projInfo?.name || undefined,
+            userMap: new Map(),
+          });
+        }
+
+        const pg = projectMap.get(pid)!;
+        if (!pg.userMap.has(uid)) {
+          pg.userMap.set(uid, { name: uName, hours: 0 });
+        }
+        pg.userMap.get(uid)!.hours += hours;
+        continue;
+      }
+
+      // Use detailed project logs (started_at/ended_at or hours/minutes)
+      for (const log of rec.attendance_project_logs) {
+        let hours = 0;
+        if (log.hours != null || log.minutes != null) {
+          hours = (Number(log.hours) || 0) + (Number(log.minutes) || 0) / 60;
+        } else if (log.started_at && log.ended_at) {
+          hours =
+            (new Date(log.ended_at).getTime() -
+              new Date(log.started_at).getTime()) /
+            (1000 * 60 * 60);
+        } else {
+          continue;
+        }
+
+        const pid = log.project_id;
+        if (!projectMap.has(pid)) {
+          const projInfo = projectsMap.get(pid);
+          projectMap.set(pid, {
+            project_number: projInfo?.project_number || undefined,
+            project_name: projInfo?.name || undefined,
+            userMap: new Map(),
+          });
+        }
+
+        const pg = projectMap.get(pid)!;
+        if (!pg.userMap.has(uid)) {
+          pg.userMap.set(uid, { name: uName, hours: 0 });
+        }
+        pg.userMap.get(uid)!.hours += hours;
       }
-      pg.userMap.get(uid)!.hours += hours;
     }
 
     const projects = Array.from(projectMap.entries()).map(([pid, pg]) => ({
@@ -733,11 +809,7 @@ export async function getPrintData(
   const monthStart = new Date(yr, mo - 1, 1);
   const monthEnd = new Date(yr, mo, 0, 23, 59, 59);
 
-  const users = await prisma.users.findMany({
-    where: { is_active: true },
-    select: { id: true, first_name: true, last_name: true },
-    orderBy: { last_name: "asc" },
-  });
+  const users = await getAttendanceUsers();
 
   const where: Record<string, unknown> = {
     shift_date: { gte: monthStart, lte: monthEnd },
@@ -1082,6 +1154,20 @@ export async function bulkCreateAttendance(data: BulkAttendanceData) {
       }
 
       const shiftDate = new Date(Date.UTC(yr, mo - 1, day, 12, 0, 0));
+
+      if (isHoliday(dateStr)) {
+        await prisma.attendance.create({
+          data: {
+            user_id: userId,
+            shift_date: shiftDate,
+            leave_type: "holiday",
+            leave_hours: 8,
+          },
+        });
+        inserted++;
+        continue;
+      }
+
       await prisma.attendance.create({
         data: {
           user_id: userId,
@@ -1189,6 +1275,7 @@ export async function createLeave(data: LeaveData, authUserId: number) {
 }
 
 export async function punchAction(userId: number, data: PunchData) {
+  const settings = await getSystemSettings();
   const action = data.punch_action;
   const now = new Date();
   const y = now.getFullYear(),
@@ -1223,7 +1310,7 @@ export async function punchAction(userId: number, data: PunchData) {
       return { error: "Máte již aktivní směnu. Nejdříve zaznamenejte odchod." };
     }
 
-    const arrivalTime = roundUp15(now);
+    const arrivalTime = roundUp(now, settings.clock_rounding_minutes);
     const record = await prisma.attendance.create({
       data: {
         user_id: userId,
@@ -1257,7 +1344,7 @@ export async function punchAction(userId: number, data: PunchData) {
       return { error: "Nemáte aktivní směnu." };
     }
 
-    const departureTime = roundDown15(now);
+    const departureTime = roundDown(now, settings.clock_rounding_minutes);
 
     const updateData: Record<string, unknown> = {
       departure_time: departureTime,
@@ -1270,9 +1357,12 @@ export async function punchAction(userId: number, data: PunchData) {
     if (!ongoing.break_start && ongoing.arrival_time) {
       const shiftMs = departureTime.getTime() - ongoing.arrival_time.getTime();
       const shiftHours = shiftMs / (1000 * 60 * 60);
-      if (shiftHours > 6) {
+      if (shiftHours > settings.break_threshold_hours) {
         const midpoint = new Date(ongoing.arrival_time.getTime() + shiftMs / 2);
-        const breakMins = shiftHours > 12 ? 30 : 15;
+        const breakMins =
+          shiftHours > settings.break_threshold_hours * 2
+            ? settings.break_duration_long
+            : settings.break_duration_short;
         updateData.break_start = midpoint;
         updateData.break_end = new Date(
           midpoint.getTime() + breakMins * 60 * 1000,
@@ -1285,10 +1375,20 @@ export async function punchAction(userId: number, data: PunchData) {
       data: updateData,
     });
 
-    await prisma.attendance_project_logs.updateMany({
+    // End active project logs, ensuring ended_at is never before started_at
+    const activeLogs = await prisma.attendance_project_logs.findMany({
       where: { attendance_id: ongoing.id, ended_at: null },
-      data: { ended_at: departureTime },
     });
+    for (const log of activeLogs) {
+      const endedAt =
+        log.started_at && log.started_at > departureTime
+          ? log.started_at
+          : departureTime;
+      await prisma.attendance_project_logs.update({
+        where: { id: log.id },
+        data: { ended_at: endedAt },
+      });
+    }
 
     return {
       id: ongoing.id,
@@ -1311,9 +1411,11 @@ export async function punchAction(userId: number, data: PunchData) {
       return { error: "Nemáte aktivní směnu bez přestávky." };
     }
 
-    const ms10 = 10 * 60 * 1000;
-    const breakStart = new Date(Math.round(now.getTime() / ms10) * ms10);
-    const breakEnd = new Date(breakStart.getTime() + 30 * 60 * 1000);
+    const msRound = settings.clock_rounding_minutes * 60 * 1000;
+    const breakStart = new Date(Math.round(now.getTime() / msRound) * msRound);
+    const breakEnd = new Date(
+      breakStart.getTime() + settings.break_duration_long * 60 * 1000,
+    );
 
     await prisma.attendance.update({
       where: { id: ongoing.id },

src/services/audit.ts

@@ -2,6 +2,27 @@ import { FastifyRequest } from "fastify";
 import prisma from "../config/database";
 import { AuditAction, EntityType, AuthData } from "../types";
 
+/**
+ * Safe JSON.stringify replacer that handles Prisma Decimal and BigInt
+ * by converting them to strings. Prevents JSON.stringify from throwing
+ * on values that include these types.
+ */
+function safeJsonReplacer(_key: string, value: unknown): unknown {
+  if (typeof value === "bigint") return String(value);
+  if (
+    value !== null &&
+    typeof value === "object" &&
+    "toString" in value &&
+    typeof (value as any).toString === "function" &&
+    "toNumber" in value &&
+    typeof (value as any).toNumber === "function"
+  ) {
+    // Prisma Decimal
+    return (value as any).toString();
+  }
+  return value;
+}
+
 export async function logAudit(params: {
   request: FastifyRequest;
   authData?: AuthData | null;
@@ -22,8 +43,12 @@ export async function logAudit(params: {
         entity_type: params.entityType ?? null,
         entity_id: params.entityId ?? null,
         description: params.description ?? null,
-        old_values: params.oldValues ? JSON.stringify(params.oldValues) : null,
-        new_values: params.newValues ? JSON.stringify(params.newValues) : null,
+        old_values: params.oldValues
+          ? JSON.stringify(params.oldValues, safeJsonReplacer)
+          : null,
+        new_values: params.newValues
+          ? JSON.stringify(params.newValues, safeJsonReplacer)
+          : null,
         user_agent: params.request.headers["user-agent"] ?? null,
         session_id: null,
       },

src/services/auth.ts

@@ -5,6 +5,7 @@ import { FastifyRequest, FastifyReply } from "fastify";
 import prisma from "../config/database";
 import { config } from "../config/env";
 import { AuthData, JwtPayload } from "../types";
+import { getSystemSettings } from "./system-settings";
 
 // Pre-computed bcrypt hash for timing-safe comparison when user not found
 const DUMMY_HASH =
@@ -121,14 +122,15 @@ export async function login(
 
   const passwordValid = await bcrypt.compare(password, user.password_hash);
   if (!passwordValid) {
+    const settings = await getSystemSettings();
     const attempts = (user.failed_login_attempts ?? 0) + 1;
     const updateData: Record<string, unknown> = {
       failed_login_attempts: attempts,
     };
 
-    if (attempts >= config.security.maxLoginAttempts) {
+    if (attempts >= settings.max_login_attempts) {
       updateData.locked_until = new Date(
-        Date.now() + config.security.lockoutMinutes * 60_000,
+        Date.now() + settings.lockout_minutes * 60_000,
       );
     }
 

src/services/exchange-rates.ts

@@ -0,0 +1,65 @@
+/**
+ * Czech National Bank (ČNB) exchange rate service.
+ * Fetches daily rates and caches them.
+ * API: https://api.cnb.cz/cnbapi/exrates/daily
+ */
+
+interface CnbRate {
+  currencyCode: string;
+  rate: number;
+  amount: number;
+}
+
+const rateCache: Record<string, Record<string, number>> = {};
+
+async function fetchRatesForDate(
+  date?: string,
+): Promise<Record<string, number>> {
+  const key = date || "today";
+  if (rateCache[key]) return rateCache[key];
+
+  try {
+    let url = "https://api.cnb.cz/cnbapi/exrates/daily?lang=EN";
+    if (date) url += `&date=${date}`;
+
+    const response = await fetch(url);
+    if (!response.ok) throw new Error(`CNB API: ${response.status}`);
+
+    const data = (await response.json()) as { rates: CnbRate[] };
+    const rates: Record<string, number> = { CZK: 1 };
+
+    for (const r of data.rates) {
+      rates[r.currencyCode] = r.rate / r.amount;
+    }
+
+    rateCache[key] = rates;
+    return rates;
+  } catch (err) {
+    console.error("Failed to fetch CNB exchange rates:", err);
+    if (rateCache["today"]) return rateCache["today"];
+    return { CZK: 1, EUR: 25, USD: 22, GBP: 28 };
+  }
+}
+
+/** Convert an amount from a given currency to CZK using CNB rates */
+export async function toCzk(
+  amount: number,
+  currency: string,
+  date?: string,
+): Promise<number> {
+  if (currency === "CZK") return amount;
+  const rates = await fetchRatesForDate(date);
+  const rate = rates[currency];
+  if (!rate) return amount;
+  return Math.round(amount * rate * 100) / 100;
+}
+
+/** Get CNB rate for a currency (CZK per 1 unit), optionally for a specific date */
+export async function getRate(
+  currency: string,
+  date?: string,
+): Promise<number> {
+  if (currency === "CZK") return 1;
+  const rates = await fetchRatesForDate(date);
+  return rates[currency] || 1;
+}

src/services/invoice-alerts.ts

@@ -2,6 +2,7 @@ import prisma from "../config/database";
 import { config } from "../config/env";
 import { sendMail } from "./mailer";
 import { localDateCzStr, localDateStr } from "../utils/date";
+import { getSystemSettings } from "./system-settings";
 
 interface AlertInvoice {
   id: number;
@@ -31,7 +32,8 @@ function formatAmount(n: number | { toNumber?: () => number }): string {
 }
 
 export async function checkInvoiceAlerts(): Promise<void> {
-  const alertEmail = config.email.invoiceAlert;
+  const settings = await getSystemSettings();
+  const alertEmail = settings.invoice_alert_email || config.email.invoiceAlert;
   if (!alertEmail) return;
 
   const today = new Date();
@@ -97,14 +99,6 @@ export async function checkInvoiceAlerts(): Promise<void> {
       due_date: localDateCzStr(new Date(inv.due_date)),
       days_label: daysLabel,
     });
-
-    await prisma.invoice_alert_log.create({
-      data: {
-        invoice_type: "created",
-        invoice_id: inv.id,
-        alert_type: alertType,
-      },
-    });
   }
 
   // --- Received invoices (we owe supplier) ---
@@ -153,14 +147,6 @@ export async function checkInvoiceAlerts(): Promise<void> {
       due_date: localDateCzStr(new Date(inv.due_date)),
       days_label: daysLabel,
     });
-
-    await prisma.invoice_alert_log.create({
-      data: {
-        invoice_type: "received",
-        invoice_id: inv.id,
-        alert_type: alertType,
-      },
-    });
   }
 
   if (alerts.length === 0) return;
@@ -219,9 +205,26 @@ export async function checkInvoiceAlerts(): Promise<void> {
   const sent = await sendMail(alertEmail, subject, html);
   if (!sent) {
     console.error(`InvoiceAlerts: Failed to send alert to ${alertEmail}`);
-  } else {
-    console.log(
-      `InvoiceAlerts: Sent ${alerts.length} alert(s) to ${alertEmail}`,
-    );
+    return;
+  }
+
+  console.log(`InvoiceAlerts: Sent ${alerts.length} alert(s) to ${alertEmail}`);
+
+  // Mark alerts as sent only after successful delivery
+  for (const a of alerts) {
+    await prisma.invoice_alert_log.create({
+      data: {
+        invoice_type: a.type,
+        invoice_id: a.id,
+        alert_type:
+          a.type === "created"
+            ? a.days_label.includes("dnes")
+              ? "due"
+              : "3days"
+            : a.days_label.includes("dnes")
+              ? "due"
+              : "3days",
+      },
+    });
   }
 }

src/services/invoices.service.ts

@@ -1,4 +1,9 @@
 import prisma from "../config/database";
+import { toCzk } from "./exchange-rates";
+import {
+  generateInvoiceNumber,
+  releaseInvoiceNumber,
+} from "./numbering.service";
 
 // Status transition rules matching PHP
 const VALID_TRANSITIONS: Record<string, string[]> = {
@@ -69,8 +74,13 @@ export async function markOverdueInvoices() {
       where: { status: "issued", due_date: { lt: new Date() } },
       data: { status: "overdue" },
     });
-  } catch {
-    /* silent */
+    // Reverse: if due_date was changed to future, set back to issued
+    await prisma.invoices.updateMany({
+      where: { status: "overdue", due_date: { gte: new Date() } },
+      data: { status: "issued" },
+    });
+  } catch (err) {
+    console.error("markOverdueInvoices failed:", err);
   }
 }
 
@@ -141,26 +151,10 @@ export async function listInvoices(params: ListInvoicesParams) {
   return { data: enriched, total, page, limit };
 }
 
-export async function getNextInvoiceNumberFormatted() {
-  const settings = await prisma.company_settings.findFirst({
-    select: { invoice_type_code: true },
-  });
-  const typeCode = settings?.invoice_type_code || "81";
-  const yy = String(new Date().getFullYear()).slice(-2);
-  const prefix = `${yy}${typeCode}`;
-  const prefixLen = prefix.length;
-  const likePattern = `${prefix}%`;
-
-  // MAX from existing invoices — same approach as offers/orders
-  const result = await prisma.$queryRaw<[{ max_num: bigint | null }]>`
-    SELECT COALESCE(MAX(CAST(SUBSTRING(invoice_number, ${prefixLen} + 1) AS UNSIGNED)), 0) as max_num
-    FROM invoices
-    WHERE invoice_number LIKE ${likePattern}
-  `;
-  const nextNum = Number(result[0]?.max_num ?? 0) + 1;
-  const number = `${prefix}${String(nextNum).padStart(4, "0")}`;
-  return { number, next_number: number };
-}
+export {
+  generateInvoiceNumber as getNextInvoiceNumberFormatted,
+  previewInvoiceNumber as getNextInvoiceNumberPreview,
+} from "./numbering.service";
 
 export async function getInvoiceStats(queryMonth?: number, queryYear?: number) {
   const now = new Date();
@@ -205,10 +199,11 @@ export async function getInvoiceStats(queryMonth?: number, queryYear?: number) {
       }));
   };
 
-  const sumCzk = (invoices: typeof allInvoices) => {
+  const sumCzk = async (invoices: typeof allInvoices) => {
     let total = 0;
     for (const inv of invoices) {
-      total += invoiceTotalWithVat(inv); // Simplified: no real FX conversion
+      const amount = invoiceTotalWithVat(inv);
+      total += await toCzk(amount, inv.currency || "CZK");
     }
     return Math.round(total * 100) / 100;
   };
@@ -243,18 +238,24 @@ export async function getInvoiceStats(queryMonth?: number, queryYear?: number) {
   let vatCzk = 0;
   for (const [, v] of Object.entries(vatMap)) vatCzk += v;
 
+  // VAT also needs conversion
+  let vatCzkConverted = 0;
+  for (const [cur, amount] of Object.entries(vatMap)) {
+    vatCzkConverted += await toCzk(amount, cur);
+  }
+
   return {
     paid_month: aggregateByCurrency(paidInvoices),
-    paid_month_czk: sumCzk(paidInvoices),
+    paid_month_czk: await sumCzk(paidInvoices),
     paid_month_count: paidInvoices.length,
     awaiting: aggregateByCurrency(awaitingInvoices),
-    awaiting_czk: sumCzk(awaitingInvoices),
+    awaiting_czk: await sumCzk(awaitingInvoices),
     awaiting_count: awaitingInvoices.length,
     overdue: aggregateByCurrency(overdueInvoices),
-    overdue_czk: sumCzk(overdueInvoices),
+    overdue_czk: await sumCzk(overdueInvoices),
     overdue_count: overdueInvoices.length,
     vat_month: vatAmounts,
-    vat_month_czk: Math.round(vatCzk * 100) / 100,
+    vat_month_czk: Math.round(vatCzkConverted * 100) / 100,
     month,
     year,
   };
@@ -299,9 +300,14 @@ export async function getInvoice(id: number) {
 }
 
 export async function createInvoice(body: Record<string, any>) {
+  const invoiceNumber =
+    body.invoice_number !== undefined && body.invoice_number !== null
+      ? String(body.invoice_number)
+      : (await generateInvoiceNumber()).number;
+
   const invoice = await prisma.invoices.create({
     data: {
-      invoice_number: body.invoice_number ? String(body.invoice_number) : null,
+      invoice_number: invoiceNumber,
       order_id: body.order_id ? Number(body.order_id) : null,
       customer_id: body.customer_id ? Number(body.customer_id) : null,
       status: body.status ? String(body.status) : "issued",
@@ -361,8 +367,8 @@ export async function updateInvoice(id: number, body: Record<string, any>) {
 
   const data: Record<string, unknown> = { modified_at: new Date() };
 
-  // Only allow full editing in 'issued' state
-  const isDraft = currentStatus === "issued";
+  // Allow full editing in 'issued' and 'overdue' states
+  const isDraft = currentStatus === "issued" || currentStatus === "overdue";
   if (isDraft) {
     const strFields = [
       "currency",
@@ -416,7 +422,7 @@ export async function updateInvoice(id: number, body: Record<string, any>) {
     }
   }
 
-  if (body.paid_date !== undefined)
+  if (body.paid_date !== undefined && currentStatus !== "paid")
     data.paid_date = body.paid_date ? new Date(String(body.paid_date)) : null;
 
   await prisma.invoices.update({ where: { id }, data });
@@ -447,5 +453,11 @@ export async function deleteInvoice(id: number) {
   if (!existing) return null;
 
   await prisma.invoices.delete({ where: { id } });
+
+  const year = existing.created_at
+    ? new Date(existing.created_at).getFullYear()
+    : new Date().getFullYear();
+  await releaseInvoiceNumber(year);
+
   return existing;
 }

src/services/leave-notification.ts

@@ -1,6 +1,7 @@
 import { sendMail } from "./mailer";
 import { config } from "../config/env";
 import { localDateCzStr, localDateTimeCzStr } from "../utils/date";
+import { getSystemSettings } from "./system-settings";
 
 const LEAVE_TYPE_LABELS: Record<string, string> = {
   vacation: "Dovolená",
@@ -38,7 +39,8 @@ export async function notifyNewLeaveRequest(
   request: LeaveRequestData,
   employeeName: string,
 ): Promise<void> {
-  const notifyEmail = config.email.leaveNotify;
+  const settings = await getSystemSettings();
+  const notifyEmail = settings.leave_notify_email || config.email.leaveNotify;
   if (!notifyEmail) return;
 
   const leaveType = LEAVE_TYPE_LABELS[request.leave_type] || request.leave_type;

src/services/mailer.ts

@@ -1,5 +1,6 @@
 import nodemailer from "nodemailer";
 import { config } from "../config/env";
+import { getSystemSettings } from "./system-settings";
 
 const transporter = nodemailer.createTransport({
   sendmail: true,
@@ -12,14 +13,18 @@ export async function sendMail(
   subject: string,
   html: string,
 ): Promise<boolean> {
+  const settings = await getSystemSettings();
   const from =
+    settings.smtp_from ||
     config.email.smtpFrom ||
     config.email.contactFrom ||
-    "web@boha-automation.cz";
+    "noreply@example.com";
+  const fromName =
+    settings.smtp_from_name || config.email.smtpFromName || "System";
 
   try {
     await transporter.sendMail({
-      from: { name: config.email.smtpFromName, address: from },
+      from: { name: fromName, address: from },
       to,
       subject,
       html,

src/services/nas-file-manager.ts

@@ -545,13 +545,14 @@ export class NasFileManager {
   }
 
   private buildFolderName(projectNumber: string, projectName: string): string {
+    let safeNum = projectNumber.replace(/[^\p{L}\p{N}_\-.]/gu, "");
+    safeNum = safeNum.replace(/^\.+|\.+$/g, "").trim();
     let safe = projectName.replace(/[^\p{L}\p{N}_\-. ]/gu, "");
-    safe = safe.trim().replace(/ /g, "_");
-    safe = safe.replace(/_+/g, "_");
+    safe = safe.trim().replace(/ /g, "_").replace(/_+/g, "_");
     if ([...safe].length > 200) {
       safe = [...safe].slice(0, 200).join("");
     }
-    return projectNumber + "_" + safe;
+    return safeNum + "_" + safe;
   }
 
   private resolveProjectPath(

src/services/nas-financials-manager.ts

@@ -30,6 +30,34 @@ class NasFinancialsManager {
 
   // ── Created (issued) invoices ────────────────────────────────────
 
+  /** Remove any existing PDF for this invoice number across all year/month folders */
+  cleanIssuedInvoice(invoiceNumber: string): void {
+    if (!this.basePath) return;
+    const safeName = this.sanitizeFilename(invoiceNumber) + ".pdf";
+    const issuedDir = path.join(this.basePath, DIR_ISSUED);
+    try {
+      if (!fs.existsSync(issuedDir)) return;
+      for (const yearDir of fs.readdirSync(issuedDir)) {
+        const yearPath = path.join(issuedDir, yearDir);
+        if (!fs.statSync(yearPath).isDirectory()) continue;
+        for (const monthDir of fs.readdirSync(yearPath)) {
+          const monthPath = path.join(yearPath, monthDir);
+          try {
+            if (!fs.statSync(monthPath).isDirectory()) continue;
+          } catch {
+            continue;
+          }
+          const filePath = path.join(monthPath, safeName);
+          if (fs.existsSync(filePath)) {
+            fs.unlinkSync(filePath);
+          }
+        }
+      }
+    } catch {
+      // best effort
+    }
+  }
+
   saveIssuedInvoicePdf(
     invoiceNumber: string,
     year: number,

src/services/numbering.service.ts

@@ -1,75 +1,293 @@
 import prisma from "../config/database";
+import type { PrismaClient } from "@prisma/client";
+
+// Prisma transaction client (omit methods not available inside $transaction)
+type TxClient = Omit<
+  PrismaClient,
+  "$connect" | "$disconnect" | "$on" | "$transaction" | "$extends"
+>;
+
+// Default patterns (backward compatible with existing numbers)
+const DEFAULT_OFFER_PATTERN = "{YYYY}/{PREFIX}/{NNN}";
+const DEFAULT_ORDER_PATTERN = "{YY}{CODE}{NNNN}";
+const DEFAULT_INVOICE_PATTERN = "{YY}{CODE}{NNNN}";
 
 /**
- * Shared number generator for orders and projects.
- * Format: YYtypeCode + 4-digit sequence (e.g., 26710003)
- * Queries MAX from both orders and projects tables.
+ * Apply a numbering pattern template.
+ * Placeholders: {YYYY}, {YY}, {PREFIX}, {CODE}, {N+} (padding = count of N's)
  */
-export async function generateSharedNumber(): Promise<string> {
-  const settings = await prisma.company_settings.findFirst({
-    select: { order_type_code: true },
-  });
-  const typeCode = settings?.order_type_code || "71";
-  const yy = String(new Date().getFullYear()).slice(-2);
-  const prefix = `${yy}${typeCode}`;
-  const prefixLen = prefix.length;
-  const likePattern = `${prefix}%`;
+function applyPattern(
+  pattern: string,
+  vars: { year: number; prefix: string; code: string; seq: number },
+): string {
+  const yyyy = String(vars.year);
+  const yy = yyyy.slice(-2);
 
-  const result = await prisma.$queryRaw<[{ max_seq: bigint | null }]>`
-    SELECT COALESCE(MAX(seq), 0) as max_seq FROM (
-      SELECT CAST(SUBSTRING(order_number, ${prefixLen} + 1) AS UNSIGNED) AS seq
-      FROM orders WHERE order_number LIKE ${likePattern}
-      UNION ALL
-      SELECT CAST(SUBSTRING(project_number, ${prefixLen} + 1) AS UNSIGNED) AS seq
-      FROM projects WHERE project_number LIKE ${likePattern}
-    ) combined
-  `;
-  const nextNum = Number(result[0]?.max_seq ?? 0) + 1;
-  return `${prefix}${String(nextNum).padStart(4, "0")}`;
+  return pattern.replace(/\{(\w+)\}/g, (match, key: string) => {
+    if (key === "YYYY") return yyyy;
+    if (key === "YY") return yy;
+    if (key === "PREFIX") return vars.prefix;
+    if (key === "CODE") return vars.code;
+    if (/^N+$/.test(key)) return String(vars.seq).padStart(key.length, "0");
+    return match;
+  });
+}
+
+async function getSettings() {
+  return prisma.company_settings.findFirst({
+    select: {
+      quotation_prefix: true,
+      order_type_code: true,
+      invoice_type_code: true,
+      offer_number_pattern: true,
+      order_number_pattern: true,
+      invoice_number_pattern: true,
+    },
+  });
 }
 
 /**
- * Next offer number. Queries MAX from quotations table.
- * Format: YEAR/PREFIX/NNN (e.g., 2026/NA/008)
+ * Atomically get the next sequence number for a given type and year.
+ * Uses SELECT ... FOR UPDATE inside a transaction to prevent races.
+ * If `tx` is provided, the increment happens inside the caller's transaction
+ * (no nested transaction is created).
  */
-export async function generateOfferNumber(): Promise<string> {
-  const settings = await prisma.company_settings.findFirst({
-    select: { quotation_prefix: true },
-  });
-  const prefix = settings?.quotation_prefix || "NA";
-  const year = new Date().getFullYear();
-  const likePattern = `${year}/${prefix}/%`;
+async function getNextSequence(
+  type: string,
+  year: number,
+  tx?: TxClient,
+): Promise<number> {
+  const exec = async (client: TxClient) => {
+    const existing = await client.$queryRaw<
+      Array<{ id: number; last_number: number }>
+    >`
+      SELECT id, last_number FROM number_sequences
+      WHERE \`type\` = ${type} AND \`year\` = ${year}
+      FOR UPDATE
+    `;
 
-  const result = await prisma.$queryRaw<[{ max_num: bigint | null }]>`
-    SELECT COALESCE(MAX(CAST(SUBSTRING_INDEX(quotation_number, '/', -1) AS UNSIGNED)), 0) as max_num
-    FROM quotations
-    WHERE quotation_number LIKE ${likePattern}
-  `;
-  const nextNum = Number(result[0]?.max_num ?? 0) + 1;
-  return `${year}/${prefix}/${String(nextNum).padStart(3, "0")}`;
-}
-
-/**
- * Next invoice number via atomic sequence table.
- */
-export async function generateInvoiceNumber(year: number): Promise<number> {
-  return prisma.$transaction(async (tx) => {
-    const existing = await tx.number_sequences.findFirst({
-      where: { type: "invoice", year },
-    });
-
-    if (existing) {
-      const nextNum = (existing.last_number ?? 0) + 1;
-      await tx.number_sequences.update({
-        where: { id: existing.id },
-        data: { last_number: nextNum },
-      });
-      return nextNum;
+    if (existing.length === 0) {
+      await client.$executeRaw`
+        INSERT INTO number_sequences (\`type\`, \`year\`, \`last_number\`)
+        VALUES (${type}, ${year}, 1)
+      `;
+      return 1;
     }
 
-    await tx.number_sequences.create({
-      data: { type: "invoice", year, last_number: 1 },
-    });
+    const next = existing[0].last_number + 1;
+    await client.$executeRaw`
+      UPDATE number_sequences
+      SET \`last_number\` = ${next}
+      WHERE id = ${existing[0].id}
+    `;
+    return next;
+  };
+
+  if (tx) {
+    return exec(tx);
+  }
+  return prisma.$transaction(exec);
+}
+
+/**
+ * Preview the next sequence number without consuming it.
+ */
+async function previewNextSequence(
+  type: string,
+  year: number,
+): Promise<number> {
+  const existing = await prisma.$queryRaw<Array<{ last_number: number }>>`
+    SELECT last_number FROM number_sequences
+    WHERE \`type\` = ${type} AND \`year\` = ${year}
+  `;
+
+  if (existing.length === 0) {
     return 1;
+  }
+
+  return existing[0].last_number + 1;
+}
+
+/**
+ * Decrement the sequence counter for a given type/year.
+ * Called after deleting a document so the number can be reused.
+ */
+async function releaseSequence(type: string, year: number) {
+  try {
+    await prisma.$executeRaw`
+      UPDATE number_sequences
+      SET last_number = GREATEST(COALESCE(last_number, 0) - 1, 0)
+      WHERE \`type\` = ${type} AND \`year\` = ${year}
+    `;
+  } catch (err) {
+    // Non-fatal: log but don't fail the delete operation
+    console.error(`releaseSequence failed for ${type}/${year}:`, err);
+  }
+}
+
+/** Verify a shared number is not already used by an order or project. */
+async function isSharedNumberTaken(number: string): Promise<boolean> {
+  const [existingOrder, existingProject] = await Promise.all([
+    prisma.orders.findFirst({ where: { order_number: number } }),
+    prisma.projects.findFirst({ where: { project_number: number } }),
+  ]);
+  return !!(existingOrder || existingProject);
+}
+
+/** Verify an invoice number is not already used. */
+async function isInvoiceNumberTaken(number: string): Promise<boolean> {
+  const existing = await prisma.invoices.findFirst({
+    where: { invoice_number: number },
+  });
+  return !!existing;
+}
+
+/** Verify an offer/quotation number is not already used. */
+async function isOfferNumberTaken(number: string): Promise<boolean> {
+  const existing = await prisma.quotations.findFirst({
+    where: { quotation_number: number },
+  });
+  return !!existing;
+}
+
+/**
+ * Next offer/quotation number (consumes sequence).
+ * Verifies uniqueness against the quotations table; retries if taken.
+ * Pass `tx` when calling inside an existing Prisma transaction.
+ */
+export async function generateOfferNumber(tx?: TxClient): Promise<string> {
+  const settings = await getSettings();
+  const pattern = settings?.offer_number_pattern || DEFAULT_OFFER_PATTERN;
+  const prefix = settings?.quotation_prefix || "NA";
+  const year = new Date().getFullYear();
+
+  for (let attempt = 0; attempt < 100; attempt++) {
+    const seq = await getNextSequence("offer", year, tx);
+    const number = applyPattern(pattern, { year, prefix, code: "", seq });
+    if (!(await isOfferNumberTaken(number))) {
+      return number;
+    }
+  }
+
+  throw new Error("Nepodařilo se vygenerovat jedinečné číslo nabídky");
+}
+
+/**
+ * Preview next offer/quotation number (does NOT consume sequence).
+ */
+export async function previewOfferNumber(): Promise<string> {
+  const settings = await getSettings();
+  const pattern = settings?.offer_number_pattern || DEFAULT_OFFER_PATTERN;
+  const prefix = settings?.quotation_prefix || "NA";
+  const year = new Date().getFullYear();
+
+  const seq = await previewNextSequence("offer", year);
+  return applyPattern(pattern, { year, prefix, code: "", seq });
+}
+
+/**
+ * Shared number for orders and projects (consumes sequence).
+ * Verifies uniqueness against both orders and projects tables; retries if taken.
+ * Pass `tx` when calling inside an existing Prisma transaction.
+ */
+export async function generateSharedNumber(tx?: TxClient): Promise<string> {
+  const settings = await getSettings();
+  const pattern = settings?.order_number_pattern || DEFAULT_ORDER_PATTERN;
+  const code = settings?.order_type_code || "71";
+  const year = new Date().getFullYear();
+
+  for (let attempt = 0; attempt < 100; attempt++) {
+    const seq = await getNextSequence("shared", year, tx);
+    const number = applyPattern(pattern, { year, prefix: "", code, seq });
+    if (!(await isSharedNumberTaken(number))) {
+      return number;
+    }
+  }
+
+  throw new Error(
+    "Nepodařilo se vygenerovat jedinečné číslo objednávky/projekt",
+  );
+}
+
+/**
+ * Preview shared number for orders and projects (does NOT consume sequence).
+ */
+export async function previewSharedNumber(): Promise<string> {
+  const settings = await getSettings();
+  const pattern = settings?.order_number_pattern || DEFAULT_ORDER_PATTERN;
+  const code = settings?.order_type_code || "71";
+  const year = new Date().getFullYear();
+
+  const seq = await previewNextSequence("shared", year);
+  return applyPattern(pattern, { year, prefix: "", code, seq });
+}
+
+/**
+ * Next invoice number (consumes sequence).
+ * Verifies uniqueness against the invoices table; retries if taken.
+ * Pass `tx` when calling inside an existing Prisma transaction.
+ */
+export async function generateInvoiceNumber(
+  _year?: number,
+  tx?: TxClient,
+): Promise<{ number: string; next_number: string }> {
+  const settings = await getSettings();
+  const pattern = settings?.invoice_number_pattern || DEFAULT_INVOICE_PATTERN;
+  const code = settings?.invoice_type_code || "81";
+  const year = _year || new Date().getFullYear();
+
+  for (let attempt = 0; attempt < 100; attempt++) {
+    const seq = await getNextSequence("invoice", year, tx);
+    const number = applyPattern(pattern, { year, prefix: "", code, seq });
+    if (!(await isInvoiceNumberTaken(number))) {
+      return { number, next_number: number };
+    }
+  }
+
+  throw new Error("Nepodařilo se vygenerovat jedinečné číslo faktury");
+}
+
+/**
+ * Preview next invoice number (does NOT consume sequence).
+ */
+export async function previewInvoiceNumber(
+  _year?: number,
+): Promise<{ number: string; next_number: string }> {
+  const settings = await getSettings();
+  const pattern = settings?.invoice_number_pattern || DEFAULT_INVOICE_PATTERN;
+  const code = settings?.invoice_type_code || "81";
+  const year = _year || new Date().getFullYear();
+
+  const seq = await previewNextSequence("invoice", year);
+  const number = applyPattern(pattern, { year, prefix: "", code, seq });
+  return { number, next_number: number };
+}
+
+/** Release an offer number back to the pool (decrement sequence). */
+export async function releaseOfferNumber(year?: number) {
+  await releaseSequence("offer", year || new Date().getFullYear());
+}
+
+/** Release a shared number back to the pool (decrement sequence). */
+export async function releaseSharedNumber(year?: number) {
+  await releaseSequence("shared", year || new Date().getFullYear());
+}
+
+/** Release an invoice number back to the pool (decrement sequence). */
+export async function releaseInvoiceNumber(year?: number) {
+  await releaseSequence("invoice", year || new Date().getFullYear());
+}
+
+/** Preview what a pattern would produce (for settings UI) */
+export function previewPattern(
+  pattern: string,
+  prefix: string,
+  code: string,
+): string {
+  return applyPattern(pattern, {
+    year: new Date().getFullYear(),
+    prefix,
+    code,
+    seq: 1,
   });
 }

src/services/offers.service.ts

@@ -1,5 +1,9 @@
 import prisma from "../config/database";
-import { generateOfferNumber } from "./numbering.service";
+import {
+  generateOfferNumber,
+  previewOfferNumber,
+  releaseOfferNumber,
+} from "./numbering.service";
 
 interface QuotationItemInput {
   description?: string;
@@ -18,7 +22,7 @@ interface ScopeSectionInput {
 }
 
 // Re-export for convenience
-export { generateOfferNumber as getNextOfferNumber } from "./numbering.service";
+export { previewOfferNumber as getNextOfferNumber } from "./numbering.service";
 
 const ALLOWED_SORT_FIELDS = [
   "id",
@@ -133,11 +137,14 @@ export async function getOffer(id: number) {
 }
 
 export async function createOffer(body: Record<string, any>) {
+  const quotationNumber =
+    body.quotation_number !== undefined && body.quotation_number !== null
+      ? String(body.quotation_number)
+      : await generateOfferNumber();
+
   const quotation = await prisma.quotations.create({
     data: {
-      quotation_number: body.quotation_number
-        ? String(body.quotation_number)
-        : null,
+      quotation_number: quotationNumber,
       project_code: body.project_code ? String(body.project_code) : null,
       customer_id: body.customer_id ? Number(body.customer_id) : null,
       valid_until: body.valid_until ? new Date(String(body.valid_until)) : null,
@@ -190,13 +197,16 @@ export async function updateOffer(id: number, body: Record<string, any>) {
   if (existing.status === "invalidated")
     return { error: "invalidated" as const };
 
+  if (
+    body.quotation_number !== undefined &&
+    String(body.quotation_number) !== existing.quotation_number
+  ) {
+    return { error: "Číslo nabídky nelze změnit", status: 400 } as const;
+  }
+
   await prisma.quotations.update({
     where: { id },
     data: {
-      quotation_number:
-        body.quotation_number !== undefined
-          ? String(body.quotation_number)
-          : undefined,
       customer_id:
         body.customer_id !== undefined ? Number(body.customer_id) : undefined,
       valid_until:
@@ -281,6 +291,12 @@ export async function deleteOffer(id: number) {
   if (!existing) return null;
 
   await prisma.quotations.delete({ where: { id } });
+
+  const year = existing.created_at
+    ? new Date(existing.created_at).getFullYear()
+    : new Date().getFullYear();
+  await releaseOfferNumber(year);
+
   return existing;
 }
 

src/services/orders.service.ts

@@ -1,5 +1,9 @@
 import prisma from "../config/database";
-import { generateSharedNumber } from "./numbering.service";
+import {
+  generateSharedNumber,
+  previewSharedNumber,
+  releaseSharedNumber,
+} from "./numbering.service";
 
 interface OrderItemInput {
   description?: string | null;
@@ -180,10 +184,10 @@ export async function createOrderFromQuotation(
       status: 400,
     } as const;
 
-  const orderNumber = await generateSharedNumber();
-  const projectNumber = await generateSharedNumber();
-
   const result = await prisma.$transaction(async (tx) => {
+    const orderNumber = await generateSharedNumber(tx);
+    const projectNumber = orderNumber;
+
     const order = await tx.orders.create({
       data: {
         order_number: orderNumber,
@@ -249,14 +253,14 @@ export async function createOrderFromQuotation(
       },
     });
 
-    return { order, project };
+    return { order, project, orderNumber };
   });
 
   return {
     data: {
       order_id: result.order.id,
       id: result.order.id,
-      order_number: orderNumber,
+      order_number: result.orderNumber,
       quotationId,
     },
   };
@@ -281,9 +285,14 @@ interface CreateOrderData {
 }
 
 export async function createOrder(body: CreateOrderData) {
+  const orderNumber =
+    body.order_number !== undefined && body.order_number !== null
+      ? String(body.order_number)
+      : await generateSharedNumber();
+
   const order = await prisma.orders.create({
     data: {
-      order_number: body.order_number ?? null,
+      order_number: orderNumber,
       customer_order_number: body.customer_order_number ?? null,
       quotation_id: body.quotation_id ?? null,
       customer_id: body.customer_id ?? null,
@@ -343,6 +352,16 @@ export async function updateOrder(id: number, body: UpdateOrderData) {
 
   const currentStatus = existing.status as string;
 
+  if (
+    body.order_number !== undefined &&
+    String(body.order_number) !== existing.order_number
+  ) {
+    return {
+      error: "Číslo objednávky nelze změnit",
+      status: 400,
+    } as const;
+  }
+
   if (body.status !== undefined && String(body.status) !== currentStatus) {
     const newStatus = String(body.status);
     const allowed = VALID_TRANSITIONS[currentStatus] || [];
@@ -356,7 +375,6 @@ export async function updateOrder(id: number, body: UpdateOrderData) {
 
   const data: Record<string, unknown> = { modified_at: new Date() };
   const strFields = [
-    "order_number",
     "customer_order_number",
     "status",
     "currency",
@@ -377,17 +395,6 @@ export async function updateOrder(id: number, body: UpdateOrderData) {
 
   await prisma.orders.update({ where: { id }, data });
 
-  // Sync project_number when order_number changes (matching PHP)
-  if (
-    body.order_number !== undefined &&
-    String(body.order_number) !== existing.order_number
-  ) {
-    await prisma.projects.updateMany({
-      where: { order_id: id },
-      data: { project_number: String(body.order_number) },
-    });
-  }
-
   // Sync project status when order status changes (matching PHP)
   if (body.status !== undefined && String(body.status) !== currentStatus) {
     const statusMap: Record<string, string> = {
@@ -405,6 +412,12 @@ export async function updateOrder(id: number, body: UpdateOrderData) {
   }
 
   if (Array.isArray(body.items) || Array.isArray(body.sections)) {
+    if (currentStatus !== "prijata" && currentStatus !== "v_realizaci") {
+      return {
+        error: "Nelze upravit položky dokončené/stornované objednávky",
+        status: 400,
+      } as const;
+    }
     await prisma.$transaction(async (tx) => {
       if (Array.isArray(body.items)) {
         await tx.order_items.deleteMany({ where: { order_id: id } });
@@ -453,7 +466,7 @@ export async function deleteOrder(id: number) {
   // Delete linked project and its notes (matching PHP)
   const linkedProjects = await prisma.projects.findMany({
     where: { order_id: id },
-    select: { id: true },
+    select: { id: true, created_at: true },
   });
   if (linkedProjects.length > 0) {
     const projectIds = linkedProjects.map((p) => p.id);
@@ -464,9 +477,23 @@ export async function deleteOrder(id: number) {
   }
 
   await prisma.orders.delete({ where: { id } });
+
+  const year = existing.created_at
+    ? new Date(existing.created_at).getFullYear()
+    : new Date().getFullYear();
+  await releaseSharedNumber(year);
+
+  // Release the linked project's shared number(s) too
+  for (const p of linkedProjects) {
+    const pYear = p.created_at
+      ? new Date(p.created_at).getFullYear()
+      : new Date().getFullYear();
+    await releaseSharedNumber(pYear);
+  }
+
   return { data: { id, order_number: existing.order_number } };
 }
 
 export async function getNextOrderNumber() {
-  return generateSharedNumber();
+  return previewSharedNumber();
 }

src/services/projects.service.ts

@@ -1,5 +1,9 @@
 import prisma from "../config/database";
-import { generateSharedNumber } from "./numbering.service";
+import {
+  generateSharedNumber,
+  previewSharedNumber,
+  releaseSharedNumber,
+} from "./numbering.service";
 import { NasFileManager } from "./nas-file-manager";
 
 const nasFileManager = new NasFileManager();
@@ -76,8 +80,16 @@ export async function getProject(id: number) {
     },
   });
   if (!project) return null;
+  const { orders, quotations, customers, users, ...rest } = project;
   return {
-    ...project,
+    ...rest,
+    customer_name: customers?.name ?? null,
+    responsible_user_name: users
+      ? `${users.first_name} ${users.last_name}`
+      : null,
+    order_number: orders?.order_number ?? null,
+    order_status: orders?.status ?? null,
+    quotation_number: quotations?.quotation_number ?? null,
     has_nas_folder: project.project_number
       ? nasFileManager.projectFolderExists(project.project_number)
       : false,
@@ -85,9 +97,14 @@ export async function getProject(id: number) {
 }
 
 export async function createProject(body: Record<string, any>) {
+  const projectNumber =
+    body.project_number !== undefined && body.project_number !== null
+      ? String(body.project_number)
+      : await generateSharedNumber();
+
   const project = await prisma.projects.create({
     data: {
-      project_number: body.project_number ? String(body.project_number) : null,
+      project_number: projectNumber,
       name: body.name ? String(body.name) : null,
       customer_id: body.customer_id ? Number(body.customer_id) : null,
       responsible_user_id: body.responsible_user_id
@@ -116,8 +133,15 @@ export async function updateProject(id: number, body: Record<string, any>) {
   const existing = await prisma.projects.findUnique({ where: { id } });
   if (!existing) return null;
 
+  if (
+    body.project_number !== undefined &&
+    String(body.project_number) !== existing.project_number
+  ) {
+    return { error: "Číslo projektu nelze změnit", status: 400 };
+  }
+
   const data: Record<string, unknown> = { modified_at: new Date() };
-  const strFields = ["project_number", "name", "status", "notes"];
+  const strFields = ["name", "status", "notes"];
   for (const f of strFields)
     if (body[f] !== undefined) data[f] = body[f] ? String(body[f]) : null;
   if (body.customer_id !== undefined)
@@ -140,13 +164,14 @@ export async function updateProject(id: number, body: Record<string, any>) {
   await prisma.projects.update({ where: { id }, data });
 
   if (
-    existing.name !== data.name &&
+    body.name !== undefined &&
+    existing.name !== body.name &&
     existing.project_number &&
     nasFileManager.isConfigured()
   ) {
     nasFileManager.renameProjectFolder(
       existing.project_number,
-      String(data.name || ""),
+      String(body.name || ""),
     );
   }
 
@@ -163,6 +188,12 @@ export async function deleteProject(id: number, deleteFiles: boolean = false) {
   }
 
   await prisma.projects.delete({ where: { id } });
+
+  const year = existing.created_at
+    ? new Date(existing.created_at).getFullYear()
+    : new Date().getFullYear();
+  await releaseSharedNumber(year);
+
   return existing;
 }
 
@@ -197,5 +228,5 @@ export async function deleteProjectNote(projectId: number, noteId: number) {
 }
 
 export async function getNextProjectNumber() {
-  return generateSharedNumber();
+  return previewSharedNumber();
 }

src/services/system-settings.ts

@@ -0,0 +1,97 @@
+import prisma from "../config/database";
+
+interface SystemSettings {
+  break_threshold_hours: number;
+  break_duration_short: number;
+  break_duration_long: number;
+  clock_rounding_minutes: number;
+  invoice_alert_email: string;
+  leave_notify_email: string;
+  max_login_attempts: number;
+  lockout_minutes: number;
+  max_requests_per_minute: number;
+  default_currency: string;
+  default_vat_rate: number;
+  available_vat_rates: number[];
+  available_currencies: string[];
+  smtp_from: string;
+  smtp_from_name: string;
+}
+
+const DEFAULTS: SystemSettings = {
+  break_threshold_hours: 6,
+  break_duration_short: 15,
+  break_duration_long: 30,
+  clock_rounding_minutes: 15,
+  invoice_alert_email: "",
+  leave_notify_email: "",
+  max_login_attempts: 5,
+  lockout_minutes: 15,
+  max_requests_per_minute: 300,
+  default_currency: "CZK",
+  default_vat_rate: 21,
+  available_vat_rates: [0, 10, 12, 15, 21],
+  available_currencies: ["CZK", "EUR", "USD", "GBP"],
+  smtp_from: "",
+  smtp_from_name: "",
+};
+
+let cache: SystemSettings | null = null;
+let cacheTime = 0;
+const CACHE_TTL = 60_000; // 60 seconds
+
+export async function getSystemSettings(): Promise<SystemSettings> {
+  if (cache && Date.now() - cacheTime < CACHE_TTL) return cache;
+
+  const row = await prisma.company_settings.findFirst();
+  if (!row) {
+    cache = { ...DEFAULTS };
+    cacheTime = Date.now();
+    return cache;
+  }
+
+  let vatRates = DEFAULTS.available_vat_rates;
+  let currencies = DEFAULTS.available_currencies;
+  try {
+    if (row.available_vat_rates) vatRates = JSON.parse(row.available_vat_rates);
+  } catch {
+    /* keep default */
+  }
+  try {
+    if (row.available_currencies)
+      currencies = JSON.parse(row.available_currencies);
+  } catch {
+    /* keep default */
+  }
+
+  cache = {
+    break_threshold_hours: Number(
+      row.break_threshold_hours ?? DEFAULTS.break_threshold_hours,
+    ),
+    break_duration_short:
+      row.break_duration_short ?? DEFAULTS.break_duration_short,
+    break_duration_long:
+      row.break_duration_long ?? DEFAULTS.break_duration_long,
+    clock_rounding_minutes:
+      row.clock_rounding_minutes ?? DEFAULTS.clock_rounding_minutes,
+    invoice_alert_email: row.invoice_alert_email || "",
+    leave_notify_email: row.leave_notify_email || "",
+    max_login_attempts: row.max_login_attempts ?? DEFAULTS.max_login_attempts,
+    lockout_minutes: row.lockout_minutes ?? DEFAULTS.lockout_minutes,
+    max_requests_per_minute:
+      row.max_requests_per_minute ?? DEFAULTS.max_requests_per_minute,
+    default_currency: row.default_currency || DEFAULTS.default_currency,
+    default_vat_rate: Number(row.default_vat_rate ?? DEFAULTS.default_vat_rate),
+    available_vat_rates: vatRates,
+    available_currencies: currencies,
+    smtp_from: row.smtp_from || "",
+    smtp_from_name: row.smtp_from_name || DEFAULTS.smtp_from_name,
+  };
+  cacheTime = Date.now();
+  return cache;
+}
+
+export function invalidateSettingsCache(): void {
+  cache = null;
+  cacheTime = 0;
+}

vitest.config.ts

@@ -1,11 +1,14 @@
-import { defineConfig } from 'vitest/config';
+import { defineConfig } from "vitest/config";
+import dotenv from "dotenv";
+dotenv.config({ path: ".env.test", override: true });
 
 export default defineConfig({
   test: {
     globals: true,
-    environment: 'node',
-    setupFiles: ['./src/__tests__/setup.ts'],
+    environment: "node",
+    setupFiles: ["./src/__tests__/setup.ts"],
     testTimeout: 15000,
     hookTimeout: 15000,
+    exclude: ["dist/**", "node_modules/**"],
   },
 });