QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

lib/screens/workforce/workforce_screen.dart

@@ -4,10 +4,10 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:tasq/utils/app_time.dart';
 import 'package:timezone/timezone.dart' as tz;
 
-import '../../models/duty_schedule.dart';
-import '../../models/profile.dart';
+import '../../models/duty_schedule.model.dart';
+import '../../models/profile.model.dart';
 import '../../models/rotation_config.dart';
-import '../../models/swap_request.dart';
+import '../../models/swap_request.model.dart';
 
 import '../../providers/profile_provider.dart';
 import '../../providers/rotation_config_provider.dart';
@@ -1005,7 +1005,13 @@ class _ScheduleGeneratorPanelState
         rotationConfig: rotationConfig,
       );
       generated.sort((a, b) => a.startTime.compareTo(b.startTime));
-      final warnings = _buildWarnings(start, end, generated, rotationConfig);
+      final warnings = _buildWarnings(
+        start,
+        end,
+        generated,
+        schedules,
+        rotationConfig,
+      );
 
       if (!mounted) return;
       setState(() {
@@ -1229,6 +1235,7 @@ class _ScheduleGeneratorPanelState
         _startDate ?? AppTime.now(),
         _endDate ?? AppTime.now(),
         _draftSchedules,
+        ref.read(dutySchedulesProvider).valueOrNull ?? const [],
         ref.read(rotationConfigProvider).valueOrNull,
       );
     });
@@ -1455,6 +1462,7 @@ class _ScheduleGeneratorPanelState
         _startDate ?? result.startTime,
         _endDate ?? result.endTime,
         _draftSchedules,
+        ref.read(dutySchedulesProvider).valueOrNull ?? const [],
         ref.read(rotationConfigProvider).valueOrNull,
       );
     });
@@ -2171,6 +2179,7 @@ class _ScheduleGeneratorPanelState
     DateTime start,
     DateTime end,
     List<_DraftSchedule> drafts,
+    List<DutySchedule> existing,
     RotationConfig? rotationConfig,
   ) {
     final warnings = <String>[];
@@ -2187,15 +2196,27 @@ class _ScheduleGeneratorPanelState
         required.addAll({'am', 'pm'});
       }
 
-      final available = drafts
-          .where(
-            (draft) =>
-                draft.startTime.year == day.year &&
-                draft.startTime.month == day.month &&
-                draft.startTime.day == day.day,
-          )
-          .map((draft) => _normalizeShiftType(draft.shiftType))
-          .toSet();
+      final available = <String>{
+        ...drafts
+            .where(
+              (draft) =>
+                  draft.startTime.year == day.year &&
+                  draft.startTime.month == day.month &&
+                  draft.startTime.day == day.day,
+            )
+            .map((draft) => _coverageShiftType(draft.shiftType)),
+        // Shifts already committed for this day count as covered, so
+        // regenerating a partially/fully scheduled range doesn't report
+        // false "uncovered" gaps that contradict the Schedule tab.
+        ...existing
+            .where(
+              (schedule) =>
+                  schedule.startTime.year == day.year &&
+                  schedule.startTime.month == day.month &&
+                  schedule.startTime.day == day.day,
+            )
+            .map((schedule) => _coverageShiftType(schedule.shiftType)),
+      };
 
       for (final shift in required) {
         if (!available.contains(shift)) {
@@ -2219,6 +2240,17 @@ class _ScheduleGeneratorPanelState
     return value;
   }
 
+  // The uncovered-shifts check requires a generic 'on_call' each day, but the
+  // generator emits the weekend variants 'on_call_saturday'/'on_call_sunday'.
+  // Fold those to 'on_call' for coverage only (not for templates/generation),
+  // otherwise every Saturday and Sunday reports a false "missing On Call".
+  String _coverageShiftType(String value) {
+    if (value == 'on_call_saturday' || value == 'on_call_sunday') {
+      return 'on_call';
+    }
+    return _normalizeShiftType(value);
+  }
+
   String _shiftLabel(String value, RotationConfig? rotationConfig) {
     final configured = rotationConfig?.shiftTypes.firstWhere(
       (s) => s.id == value,