QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

supabase/migrations/20260926110000_isr_attachment_delete_hardening.sql

@@ -0,0 +1,25 @@
+-- QA-027: it_service_attachments delete was open to any signed-in user.
+--
+-- The bucket stays public for reads (per product decision), but the DELETE
+-- policy allowed ANY authenticated user to delete ANY file in the bucket
+-- (USING (bucket_id = 'it_service_attachments')). Tighten it to the uploader
+-- (storage sets objects.owner to the uploader's auth.uid) plus the privileged
+-- IT-request roles that manage requests, so users can't delete each other's
+-- attachments. Read/upload policies are left unchanged.
+
+DROP POLICY IF EXISTS "Authenticated users can delete it_service_attachments" ON storage.objects;
+CREATE POLICY "Authenticated users can delete it_service_attachments"
+  ON storage.objects
+  FOR DELETE
+  TO authenticated
+  USING (
+    bucket_id = 'it_service_attachments'
+    AND (
+      owner = auth.uid()
+      OR EXISTS (
+        SELECT 1 FROM public.profiles p
+        WHERE p.id = auth.uid()
+          AND p.role IN ('admin', 'programmer', 'dispatcher', 'it_staff')
+      )
+    )
+  );