QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

lib/providers/services_provider.dart

@@ -1,7 +1,7 @@
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
 import '../brick/cache_helpers.dart';
-import '../models/service.dart';
+import '../models/service.model.dart';
 import 'supabase_provider.dart';
 import 'stream_recovery.dart';
 import 'realtime_controller.dart';
@@ -10,9 +10,15 @@ final servicesProvider = StreamProvider<List<Service>>((ref) {
   final client = ref.watch(supabaseClientProvider);
 
   final wrapper = StreamRecoveryWrapper<Service>(
-    stream: client.from('services').stream(primaryKey: ['id']).order('name'),
+    stream: client
+        .from('services')
+        .stream(primaryKey: ['id'])
+        .order('name', ascending: true),
     onPollData: () async {
-      final data = await client.from('services').select().order('name');
+      final data = await client
+          .from('services')
+          .select()
+          .order('name', ascending: true);
       return data.map(Service.fromMap).toList();
     },
     fromMap: Service.fromMap,
@@ -33,7 +39,10 @@ final servicesProvider = StreamProvider<List<Service>>((ref) {
 
 final servicesOnceProvider = FutureProvider<List<Service>>((ref) async {
   final client = ref.watch(supabaseClientProvider);
-  final rows = await client.from('services').select().order('name');
+  final rows = await client
+      .from('services')
+      .select()
+      .order('name', ascending: true);
   return (rows as List<dynamic>)
       .map((r) => Service.fromMap(r as Map<String, dynamic>))
       .toList();