QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

lib/widgets/app_shell.dart

@@ -158,7 +158,11 @@ class _AppNavigationRailState extends State<AppNavigationRail> {
   @override
   Widget build(BuildContext context) {
     final cs = Theme.of(context).colorScheme;
-    final currentIndex = _currentIndex(widget.location, widget.items);
+    // Exact match only: routes outside the rail (profile, notifications)
+    // highlight nothing instead of falling back to Dashboard.
+    final currentIndex = widget.items.indexWhere(
+      (item) => _isSelected(widget.location, item.route),
+    );
 
     // M3 Expressive: tonal surface container instead of a hard border divider.
     // Custom scrollable layout replaces NavigationRail so items are reachable
@@ -481,15 +485,17 @@ List<NavSection> _buildSections(String role) {
       icon: Icons.groups_outlined,
       selectedIcon: Icons.groups,
     ),
-    NavItem(
-      label: 'Reports',
-      route: '/reports',
-      icon: Icons.analytics_outlined,
-      selectedIcon: Icons.analytics,
-    ),
+    if (!isStandard)
+      NavItem(
+        label: 'Reports',
+        route: '/reports',
+        icon: Icons.analytics_outlined,
+        selectedIcon: Icons.analytics,
+      ),
   ];
 
-  if (role == 'admin' || role == 'programmer' || role == 'dispatcher') {
+  // Must match the /settings guard in app_router.dart (admin/programmer).
+  if (role == 'admin' || role == 'programmer') {
     return [
       NavSection(label: 'Operations', items: mainItems),
       NavSection(

lib/widgets/office_picker.dart

@@ -1,6 +1,6 @@
 import 'package:flutter/material.dart';
 
-import '../models/office.dart';
+import '../models/office.model.dart';
 import '../theme/m3_motion.dart';
 import 'app_breakpoints.dart';
 

lib/widgets/task_assignment_section.dart

@@ -2,7 +2,7 @@ import 'package:flutter/material.dart';
 import '../theme/m3_motion.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
-import '../models/profile.dart';
+import '../models/profile.model.dart';
 import '../models/task_assignment.dart';
 import '../providers/profile_provider.dart';
 import '../providers/tasks_provider.dart';
@@ -68,13 +68,15 @@ class TaskAssignmentSection extends ConsumerWidget {
       children: [
         Row(
           children: [
-            Text(
-              'Assigned IT Staff',
-              style: Theme.of(
-                context,
-              ).textTheme.titleMedium?.copyWith(fontWeight: FontWeight.w700),
+            Expanded(
+              child: Text(
+                'Assigned IT Staff',
+                overflow: TextOverflow.ellipsis,
+                style: Theme.of(
+                  context,
+                ).textTheme.titleMedium?.copyWith(fontWeight: FontWeight.w700),
+              ),
             ),
-            const Spacer(),
             if (canAssign)
               TextButton.icon(
                 onPressed: () => _showAssignmentDialog(

lib/widgets/tasq_adaptive_list.dart

@@ -7,6 +7,7 @@ import 'package:flutter/material.dart';
 import '../theme/app_typography.dart';
 import '../theme/app_surfaces.dart';
 import '../theme/m3_motion.dart';
+import 'app_breakpoints.dart';
 import 'mono_text.dart';
 
 /// A column configuration for the [TasQAdaptiveList] desktop table view.
@@ -359,7 +360,10 @@ class TasQAdaptiveList<T> extends StatelessWidget {
 
     // On medium screens (< 1200px) hide columns that are marked hideOnMedium,
     // preventing the horizontal scrollbar from appearing on tablet viewports.
-    final isMediumScreen = constraints.maxWidth < 1200;
+    // Measure the screen, not this list: after the nav rail and page padding
+    // the list is < 1200px on most desktops, which hid e.g. Tasks' Status.
+    final isMediumScreen =
+        MediaQuery.sizeOf(context).width < AppBreakpoints.desktop;
     final visibleColumns = isMediumScreen
         ? columns.where((c) => !c.hideOnMedium).toList()
         : columns;

lib/widgets/update_dialog.dart

@@ -5,6 +5,7 @@ import 'package:flutter_quill/flutter_quill.dart' as quill;
 
 import '../models/app_version.dart';
 import '../services/app_update_service.dart';
+import '../utils/snackbar.dart';
 
 /// A reusable dialog that can render both flexible and forced updates and
 /// report download progress.  Callers should wrap this with `showDialog` and
@@ -47,9 +48,7 @@ class _UpdateDialogState extends State<UpdateDialog> {
         _failed = true;
         _downloading = false;
       });
-      ScaffoldMessenger.of(
-        context,
-      ).showSnackBar(SnackBar(content: Text('Download failed: $err')));
+      showErrorSnackBar(context, 'Download failed: $err');
     }
   }