QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

lib/routing/app_router.dart

@@ -41,6 +41,9 @@ import '../theme/m3_motion.dart';
 
 import '../utils/navigation.dart';
 
+Page<dynamic> Function(BuildContext, GoRouterState) _page(Widget child) =>
+    (context, state) => M3SharedAxisPage(key: state.pageKey, child: child);
+
 String _defaultRouteForRole(String? role) {
   switch (role) {
     case 'it_staff':
@@ -100,14 +103,18 @@ final appRouterProvider = Provider<GoRouter>((ref) {
         return _defaultRouteForRole(role);
       }
       // Deferred post-login redirect: profile loaded after the initial redirect
-      // (which fell back to /dashboard because role was null). Only fires once
-      // per sign-in and only when the user is still on /dashboard.
-      if (isSignedIn &&
-          notifier._needsRoleRedirect &&
-          role != null &&
-          state.matchedLocation == '/dashboard') {
+      // (which fell back to /dashboard because role was null). Consumed once
+      // per sign-in; only redirects when the user is still on /dashboard.
+      if (isSignedIn && notifier._needsRoleRedirect && role != null) {
         notifier._needsRoleRedirect = false;
-        return _defaultRouteForRole(role);
+        if (state.matchedLocation == '/dashboard') {
+          return _defaultRouteForRole(role);
+        }
+      }
+      // Role unknown while the profile loads: hold the deep link instead of
+      // bouncing it. RouterNotifier re-runs this once the profile arrives.
+      if (isSignedIn && profileAsync.isLoading && role == null) {
+        return null;
       }
       if (isAdminRoute && !isAdmin) {
         return '/tickets';
@@ -145,31 +152,19 @@ final appRouterProvider = Provider<GoRouter>((ref) {
         routes: [
           GoRoute(
             path: '/settings/teams',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const TeamsScreen(),
-            ),
+            pageBuilder: _page(const TeamsScreen()),
           ),
           GoRoute(
             path: '/settings/app-update',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const AppUpdateScreen(),
-            ),
+            pageBuilder: _page(const AppUpdateScreen()),
           ),
           GoRoute(
             path: '/dashboard',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const DashboardScreen(),
-            ),
+            pageBuilder: _page(const DashboardScreen()),
           ),
           GoRoute(
             path: '/tickets',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const TicketsListScreen(),
-            ),
+            pageBuilder: _page(const TicketsListScreen()),
             routes: [
               GoRoute(
                 path: ':id',
@@ -184,10 +179,7 @@ final appRouterProvider = Provider<GoRouter>((ref) {
           ),
           GoRoute(
             path: '/tasks',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const TasksListScreen(),
-            ),
+            pageBuilder: _page(const TasksListScreen()),
             routes: [
               GoRoute(
                 path: ':id',
@@ -202,10 +194,7 @@ final appRouterProvider = Provider<GoRouter>((ref) {
           ),
           GoRoute(
             path: '/it-service-requests',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const ItServiceRequestsListScreen(),
-            ),
+            pageBuilder: _page(const ItServiceRequestsListScreen()),
             routes: [
               GoRoute(
                 path: ':id',
@@ -220,80 +209,44 @@ final appRouterProvider = Provider<GoRouter>((ref) {
           ),
           GoRoute(
             path: '/announcements',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const AnnouncementsScreen(),
-            ),
+            pageBuilder: _page(const AnnouncementsScreen()),
           ),
           GoRoute(
             path: '/workforce',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const WorkforceScreen(),
-            ),
+            pageBuilder: _page(const WorkforceScreen()),
           ),
           GoRoute(
             path: '/attendance',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const AttendanceScreen(),
-            ),
+            pageBuilder: _page(const AttendanceScreen()),
           ),
           GoRoute(
             path: '/whereabouts',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const WhereaboutsScreen(),
-            ),
-          ),
-          GoRoute(
-            path: '/reports',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const ReportsScreen(),
-            ),
+            pageBuilder: _page(const WhereaboutsScreen()),
           ),
+          GoRoute(path: '/reports', pageBuilder: _page(const ReportsScreen())),
           GoRoute(
             path: '/settings/users',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const UserManagementScreen(),
-            ),
+            pageBuilder: _page(const UserManagementScreen()),
           ),
           GoRoute(
             path: '/settings/offices',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const OfficesScreen(),
-            ),
+            pageBuilder: _page(const OfficesScreen()),
           ),
           GoRoute(
             path: '/settings/geofence-test',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const GeofenceTestScreen(),
-            ),
+            pageBuilder: _page(const GeofenceTestScreen()),
           ),
           GoRoute(
             path: '/settings/permissions',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const PermissionsScreen(),
-            ),
+            pageBuilder: _page(const PermissionsScreen()),
           ),
           GoRoute(
             path: '/network-map',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const NetworkMapOverviewScreen(),
-            ),
+            pageBuilder: _page(const NetworkMapOverviewScreen()),
             routes: [
               GoRoute(
                 path: 'import',
-                pageBuilder: (context, state) => M3SharedAxisPage(
-                  key: state.pageKey,
-                  child: const NetworkMapImportScreen(),
-                ),
+                pageBuilder: _page(const NetworkMapImportScreen()),
                 routes: [
                   GoRoute(
                     path: ':importId/review',
@@ -308,10 +261,7 @@ final appRouterProvider = Provider<GoRouter>((ref) {
               ),
               GoRoute(
                 path: 'vlans',
-                pageBuilder: (context, state) => M3SharedAxisPage(
-                  key: state.pageKey,
-                  child: const NetworkMapVlanScreen(),
-                ),
+                pageBuilder: _page(const NetworkMapVlanScreen()),
               ),
               GoRoute(
                 path: 'site/:siteId',
@@ -357,18 +307,9 @@ final appRouterProvider = Provider<GoRouter>((ref) {
           ),
           GoRoute(
             path: '/notifications',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const NotificationsScreen(),
-            ),
-          ),
-          GoRoute(
-            path: '/profile',
-            pageBuilder: (context, state) => M3SharedAxisPage(
-              key: state.pageKey,
-              child: const ProfileScreen(),
-            ),
+            pageBuilder: _page(const NotificationsScreen()),
           ),
+          GoRoute(path: '/profile', pageBuilder: _page(const ProfileScreen())),
         ],
       ),
     ],