QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

lib/utils/app_time.dart

@@ -29,6 +29,16 @@ class AppTime {
     return toAppTime(DateTime.parse(value));
   }
 
+  /// "Just now", "5m ago", "3h ago", "2d ago", then a short date after a week.
+  static String relative(DateTime value) {
+    final diff = now().difference(value);
+    if (diff.inMinutes < 1) return 'Just now';
+    if (diff.inMinutes < 60) return '${diff.inMinutes}m ago';
+    if (diff.inHours < 24) return '${diff.inHours}h ago';
+    if (diff.inDays < 7) return '${diff.inDays}d ago';
+    return formatDate(value);
+  }
+
   /// Converts a [DateTime] into a human-readable short date string.
   ///
   /// Example: **Jan 05, 2025**. This matches the format previously used by

lib/utils/debouncer.dart

@@ -0,0 +1,17 @@
+import 'dart:async';
+
+/// Runs an action after [duration] of inactivity, cancelling any pending
+/// run each time [run] is called again.
+class Debouncer {
+  Debouncer(this.duration);
+
+  final Duration duration;
+  Timer? _timer;
+
+  void run(void Function() action) {
+    _timer?.cancel();
+    _timer = Timer(duration, action);
+  }
+
+  void cancel() => _timer?.cancel();
+}

lib/utils/device_security.dart

@@ -1,12 +1,14 @@
 import 'dart:io';
 
+import 'package:flutter/foundation.dart';
 import 'package:safe_device/safe_device.dart';
 
 /// Returns true if the device appears compromised for attendance purposes:
 /// rooted (Android) / jailbroken (iOS), or developer mode enabled.
 /// Returns false on any error so a detection failure never blocks a valid user.
 Future<bool> isDeviceCompromised() async {
-  if (!Platform.isAndroid && !Platform.isIOS) return false;
+  // dart:io Platform throws on web, so check kIsWeb first.
+  if (kIsWeb || (!Platform.isAndroid && !Platform.isIOS)) return false;
   try {
     final isJailBroken = await SafeDevice.isJailBroken;
     final isDeveloperMode = await SafeDevice.isDevelopmentModeEnable;

lib/utils/snackbar.dart

@@ -29,6 +29,20 @@ ContentType _mapSnackType(SnackType t) {
   }
 }
 
+/// Reduces exception dumps that callers interpolate into messages (e.g.
+/// `'Error: \$e'` → `Error: PostgrestException(message: X, code: …)`) to
+/// just the human-readable `X`, so users never see raw exception syntax.
+@visibleForTesting
+String humanizeErrorText(String text) => text
+    .replaceAllMapped(
+      RegExp(
+        r'\w*Exception\(message: (.*?)(?:, (?:statusCode|code|details|hint|error):.*)?\)$',
+        dotAll: true,
+      ),
+      (m) => m[1]!,
+    )
+    .replaceAll(RegExp(r'\bException: '), '');
+
 /// Core function used by all of the convenience helpers below.
 void showAwesomeSnackBar(
   BuildContext context, {
@@ -49,7 +63,7 @@ void showAwesomeSnackBar(
       padding: const EdgeInsets.symmetric(vertical: 12, horizontal: 8),
       child: AwesomeSnackbarContent(
         title: title,
-        message: message,
+        message: humanizeErrorText(message),
         contentType: _mapSnackType(snackType),
       ),
     ),
@@ -176,7 +190,7 @@ void showAwesomeSnackBarGlobal({
       padding: const EdgeInsets.symmetric(vertical: 12, horizontal: 8),
       child: AwesomeSnackbarContent(
         title: title,
-        message: message,
+        message: humanizeErrorText(message),
         contentType: _mapSnackType(snackType),
       ),
     ),

lib/utils/task_duration.dart

@@ -1,4 +1,4 @@
-import '../models/task_activity_log.dart';
+import '../models/task_activity_log.model.dart';
 
 /// Finds the canonical execution start time for a task.
 ///