QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

test/notification_bridge_test.dart

@@ -0,0 +1,37 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:tasq/models/notification_item.model.dart';
+import 'package:tasq/services/notification_bridge.dart';
+
+NotificationItem _n(String id, {DateTime? readAt}) => NotificationItem(
+  id: id,
+  userId: 'u',
+  actorId: null,
+  ticketId: null,
+  taskId: null,
+  itServiceRequestId: null,
+  messageId: null,
+  type: 'assignment',
+  createdAt: DateTime(2026),
+  readAt: readAt,
+);
+
+void main() {
+  test('first snapshot never raises a banner', () {
+    expect(newestArrival(null, [_n('b'), _n('a')]), isNull);
+  });
+
+  test('picks the newest unseen item, not the oldest', () {
+    final prev = [_n('a')];
+    final next = [_n('c'), _n('b'), _n('a')]; // newest-first
+    expect(newestArrival(prev, next)?.id, 'c');
+  });
+
+  test('ignores already-read and already-seen items', () {
+    final prev = [_n('a')];
+    expect(
+      newestArrival(prev, [_n('b', readAt: DateTime(2026)), _n('a')]),
+      isNull,
+    );
+    expect(newestArrival(prev, [_n('a')]), isNull);
+  });
+}