QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

lib/screens/it_service_requests/it_service_request_detail_screen.dart

@@ -9,12 +9,12 @@ import 'package:file_picker/file_picker.dart';
 import 'package:flutter_quill/flutter_quill.dart' as quill;
 import 'package:skeletonizer/skeletonizer.dart';
 
-import '../../models/it_service_request.dart';
-import '../../models/it_service_request_assignment.dart';
-import '../../models/it_service_request_activity_log.dart';
-import '../../models/it_service_request_action.dart';
-import '../../models/office.dart';
-import '../../models/profile.dart';
+import '../../models/it_service_request.model.dart';
+import '../../models/it_service_request_assignment.model.dart';
+import '../../models/it_service_request_activity_log.model.dart';
+import '../../models/it_service_request_action.model.dart';
+import '../../models/office.model.dart';
+import '../../models/profile.model.dart';
 import '../../providers/it_service_request_provider.dart';
 import '../../providers/notifications_provider.dart';
 import '../../providers/profile_provider.dart';
@@ -22,6 +22,7 @@ import '../../providers/supabase_provider.dart';
 import '../../providers/tickets_provider.dart';
 import '../../services/ai_service.dart';
 import '../../utils/app_time.dart';
+import '../../utils/debouncer.dart';
 import '../../utils/snackbar.dart';
 import '../../widgets/app_breakpoints.dart';
 import '../../widgets/gemini_animated_text_field.dart';
@@ -85,7 +86,7 @@ class _ItServiceRequestDetailScreenState
 
   Timer? _eventDetailsDebounce;
   Timer? _remarksDebounce;
-  Timer? _actionDebounce;
+  final _actionDebounce = Debouncer(const Duration(milliseconds: 800));
 
   String _eventDetailsLastPlain = '';
   String _remarksLastPlain = '';
@@ -147,7 +148,7 @@ class _ItServiceRequestDetailScreenState
     _actionTakenController?.dispose();
     _eventDetailsDebounce?.cancel();
     _remarksDebounce?.cancel();
-    _actionDebounce?.cancel();
+    _actionDebounce.cancel();
     _savedBadgeTimer?.cancel();
     _saveAnimController.dispose();
     _tabController.dispose();
@@ -1388,8 +1389,7 @@ class _ItServiceRequestDetailScreenState
     final plain = _actionTakenController!.document.toPlainText().trim();
     if (plain == _actionLastPlain) return;
     _actionLastPlain = plain;
-    _actionDebounce?.cancel();
-    _actionDebounce = Timer(const Duration(milliseconds: 800), () async {
+    _actionDebounce.run(() async {
       final delta = _actionTakenController!.document.toDelta();
       final deltaJson = jsonEncode(delta.toJson());
       if (mounted) {

lib/screens/it_service_requests/it_service_request_pdf.dart

@@ -8,10 +8,10 @@ import 'package:pdf/widgets.dart' as pw;
 import 'package:pdf/pdf.dart' as pdf;
 import 'package:printing/printing.dart';
 
-import '../../models/it_service_request.dart';
-import '../../models/it_service_request_assignment.dart';
-import '../../models/office.dart';
-import '../../models/profile.dart';
+import '../../models/it_service_request.model.dart';
+import '../../models/it_service_request_assignment.model.dart';
+import '../../models/office.model.dart';
+import '../../models/profile.model.dart';
 import '../../utils/app_time.dart';
 
 /// Build PDF bytes for IT Service Request Form.

lib/screens/it_service_requests/it_service_requests_list_screen.dart

@@ -5,10 +5,10 @@ import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:go_router/go_router.dart';
 
-import '../../models/it_service_request.dart';
-import '../../models/it_service_request_assignment.dart';
-import '../../models/office.dart';
-import '../../models/profile.dart';
+import '../../models/it_service_request.model.dart';
+import '../../models/it_service_request_assignment.model.dart';
+import '../../models/office.model.dart';
+import '../../models/profile.model.dart';
 import '../../brick/cache_helpers.dart';
 import '../../providers/it_service_request_provider.dart';
 import '../../providers/profile_provider.dart';
@@ -430,9 +430,16 @@ class _ItServiceRequestsListScreenState
                   onPressed: () => Navigator.pop(ctx, false),
                   child: const Text('Cancel'),
                 ),
-                FilledButton(
-                  onPressed: () => Navigator.pop(ctx, true),
-                  child: const Text('Create'),
+                // Disabled until named, so the dialog never closes and drops
+                // the user's input on a validation failure.
+                ValueListenableBuilder<TextEditingValue>(
+                  valueListenable: nameController,
+                  builder: (context, value, child) => FilledButton(
+                    onPressed: value.text.trim().isEmpty
+                        ? null
+                        : () => Navigator.pop(ctx, true),
+                    child: const Text('Create'),
+                  ),
                 ),
               ],
             );
@@ -442,10 +449,6 @@ class _ItServiceRequestsListScreenState
     );
 
     if (result != true || !context.mounted) return;
-    if (nameController.text.trim().isEmpty) {
-      showWarningSnackBar(context, 'Event name is required');
-      return;
-    }
 
     try {
       final ctrl = ref.read(itServiceRequestControllerProvider);