QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

lib/providers/chat_provider.dart

@@ -4,7 +4,7 @@ import 'package:supabase_flutter/supabase_flutter.dart';
 import 'package:uuid/uuid.dart';
 
 import '../brick/cache_helpers.dart';
-import '../models/chat_message.dart';
+import '../models/chat_message.model.dart';
 import '../utils/app_time.dart';
 import '../utils/snackbar.dart' show isOfflineSaveError;
 import 'connectivity_provider.dart';
@@ -42,21 +42,22 @@ final chatMessagesProvider = StreamProvider.family<List<ChatMessage>, String>((
       byId.putIfAbsent(p.id, () => p);
     }
     return byId.values.toList()
-      ..sort((a, b) => a.createdAt.compareTo(b.createdAt));
+      ..sort((a, b) => b.createdAt.compareTo(a.createdAt));
   }
 
+  // Newest-first everywhere: the swap chat renders with ListView(reverse: true).
   final wrapper = StreamRecoveryWrapper<ChatMessage>(
     stream: client
         .from('chat_messages')
         .stream(primaryKey: ['id'])
         .eq('thread_id', threadId)
-        .order('created_at'),
+        .order('created_at', ascending: false),
     onPollData: () async {
       final data = await client
           .from('chat_messages')
           .select()
           .eq('thread_id', threadId)
-          .order('created_at');
+          .order('created_at', ascending: false);
       return data.map(ChatMessage.fromMap).toList();
     },
     fromMap: ChatMessage.fromMap,
@@ -64,10 +65,8 @@ final chatMessagesProvider = StreamProvider.family<List<ChatMessage>, String>((
     onStatusChanged: ref.read(realtimeControllerProvider).handleChannelStatus,
     onOfflineData: () async {
       final all = await cachedListFromBrick<ChatMessage>();
-      final filtered = all
-          .where((m) => m.threadId == threadId)
-          .toList()
-        ..sort((a, b) => a.createdAt.compareTo(b.createdAt));
+      final filtered = all.where((m) => m.threadId == threadId).toList()
+        ..sort((a, b) => b.createdAt.compareTo(a.createdAt));
       return applyPending(filtered);
     },
     onCacheMirror: (rows) =>