QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

lib/screens/auth/login_screen.dart

@@ -72,9 +72,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
         email: _emailController.text.trim(),
         password: _passwordController.text,
       );
-      if (response.session != null && mounted) {
-        context.go('/tickets');
-      } else if (mounted) {
+      // On success the router's auth redirect sends each role to its landing
+      // route (_defaultRouteForRole), so don't navigate here.
+      if (response.session == null && mounted) {
         showInfoSnackBar(context, 'Check your email to confirm sign-in.');
       }
     } on Exception catch (error) {
@@ -205,6 +205,9 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
                                     labelText: 'Password',
                                     prefixIcon: const Icon(Icons.lock_outlined),
                                     suffixIcon: IconButton(
+                                      tooltip: _obscurePassword
+                                          ? 'Show password'
+                                          : 'Hide password',
                                       icon: Icon(
                                         _obscurePassword
                                             ? Icons.visibility_outlined