QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

lib/providers/announcements_provider.dart

@@ -3,8 +3,8 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:uuid/uuid.dart';
 
 import '../brick/cache_helpers.dart';
-import '../models/announcement.dart';
-import '../models/announcement_comment.dart';
+import '../models/announcement.model.dart';
+import '../models/announcement_comment.model.dart';
 import '../utils/app_time.dart';
 import '../utils/snackbar.dart' show isOfflineSaveError;
 import 'connectivity_provider.dart';
@@ -273,35 +273,37 @@ final announcementCommentsProvider =
       ..sort((a, b) => a.createdAt.compareTo(b.createdAt));
   }
 
-  final wrapper = StreamRecoveryWrapper<AnnouncementComment>(
-    stream: client
-        .from('announcement_comments')
-        .stream(primaryKey: ['id'])
-        .eq('announcement_id', announcementId)
-        .order('created_at'),
-    onPollData: () async {
-      final data = await client
-          .from('announcement_comments')
-          .select()
-          .eq('announcement_id', announcementId)
-          .order('created_at');
-      return data.map(AnnouncementComment.fromMap).toList();
-    },
-    fromMap: AnnouncementComment.fromMap,
-    channelName: 'announcement_comments_$announcementId',
-    onStatusChanged: ref.read(realtimeControllerProvider).handleChannelStatus,
-    onOfflineData: () async {
-      final all = await cachedListFromBrick<AnnouncementComment>();
-      final filtered = all
-          .where((c) => c.announcementId == announcementId)
-          .toList()
-        ..sort((a, b) => a.createdAt.compareTo(b.createdAt));
-      return applyPending(filtered);
-    },
-    onCacheMirror: (rows) => mirrorBatchToBrick<AnnouncementComment>(
-        rows,
-        tag: 'announcement_comments'),
-  );
+      final wrapper = StreamRecoveryWrapper<AnnouncementComment>(
+        stream: client
+            .from('announcement_comments')
+            .stream(primaryKey: ['id'])
+            .eq('announcement_id', announcementId)
+            .order('created_at', ascending: true),
+        onPollData: () async {
+          final data = await client
+              .from('announcement_comments')
+              .select()
+              .eq('announcement_id', announcementId)
+              .order('created_at', ascending: true);
+          return data.map(AnnouncementComment.fromMap).toList();
+        },
+        fromMap: AnnouncementComment.fromMap,
+        channelName: 'announcement_comments_$announcementId',
+        onStatusChanged: ref
+            .read(realtimeControllerProvider)
+            .handleChannelStatus,
+        onOfflineData: () async {
+          final all = await cachedListFromBrick<AnnouncementComment>();
+          final filtered =
+              all.where((c) => c.announcementId == announcementId).toList()
+                ..sort((a, b) => a.createdAt.compareTo(b.createdAt));
+          return applyPending(filtered);
+        },
+        onCacheMirror: (rows) => mirrorBatchToBrick<AnnouncementComment>(
+          rows,
+          tag: 'announcement_comments',
+        ),
+      );
 
   ref.onDispose(wrapper.dispose);
   return wrapper.stream.map((result) => applyPending(result.data));