QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

lib/main.dart

@@ -249,8 +249,7 @@ Future<void> _firebaseMessagingBackgroundHandler(RemoteMessage message) async {
 
 Future<void> main() async {
   WidgetsFlutterBinding.ensureInitialized();
-  // The flag optionally hides annoying WASM warnings in your Chrome dev console
-  pdfrxFlutterInitialize(dismissPdfiumWasmWarnings: true);
+  pdfrxFlutterInitialize();
 
   // initialize Firebase before anything that uses messaging
   try {
@@ -768,6 +767,10 @@ class _UpdateCheckWrapperState extends State<UpdateCheckWrapper> {
 
   @override
   Widget build(BuildContext context) {
+    // Web has no update check. Skip the wrapper MaterialApp there: its plain
+    // Navigator gets the browser URL as its initial route and logs "Could not
+    // navigate to initial route" on every deep link.
+    if (kIsWeb) return const NotificationBridge(child: TasqApp());
     return MaterialApp(
       debugShowCheckedModeBanner: false,
       theme: AppTheme.light(),
@@ -791,14 +794,12 @@ class _UpdateCheckWrapperState extends State<UpdateCheckWrapper> {
             ),
           );
         },
-        child: kIsWeb
+        child: _done
             ? const NotificationBridge(child: TasqApp())
-            : (_done
-                  ? const NotificationBridge(child: TasqApp())
-                  : UpdateCheckingScreen(
-                      checkForUpdates: _checkForUpdates,
-                      onCompleted: _handleUpdateComplete,
-                    )),
+            : UpdateCheckingScreen(
+                checkForUpdates: _checkForUpdates,
+                onCompleted: _handleUpdateComplete,
+              ),
       ),
     );
   }