QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

test/offline_sync_test.dart

@@ -86,10 +86,10 @@ void main() {
       await tester.pumpWidget(buildBanner(online: true));
       await tester.pump();
 
-      expect(find.byIcon(Icons.wifi_off), findsNothing);
+      expect(find.byIcon(Icons.wifi_off_rounded), findsNothing);
       expect(
         find.text(
-          'No internet \u2014 changes saved locally, will sync automatically',
+          'No internet \u2014 changes saved locally',
         ),
         findsNothing,
       );
@@ -99,10 +99,10 @@ void main() {
       await tester.pumpWidget(buildBanner(online: false));
       await tester.pump();
 
-      expect(find.byIcon(Icons.wifi_off), findsOneWidget);
+      expect(find.byIcon(Icons.wifi_off_rounded), findsOneWidget);
       expect(
         find.text(
-          'No internet \u2014 changes saved locally, will sync automatically',
+          'No internet \u2014 changes saved locally',
         ),
         findsOneWidget,
       );
@@ -127,12 +127,12 @@ void main() {
         ),
       );
       await tester.pump();
-      expect(find.byIcon(Icons.wifi_off), findsOneWidget);
+      expect(find.byIcon(Icons.wifi_off_rounded), findsOneWidget);
 
       // Go online — update provider state, then let AnimatedSize animate.
       container.read(isOnlineProvider.notifier).state = true;
       await tester.pumpAndSettle();
-      expect(find.byIcon(Icons.wifi_off), findsNothing);
+      expect(find.byIcon(Icons.wifi_off_rounded), findsNothing);
     });
 
     testWidgets('banner transitions from online to offline', (tester) async {
@@ -151,12 +151,12 @@ void main() {
         ),
       );
       await tester.pump();
-      expect(find.byIcon(Icons.wifi_off), findsNothing);
+      expect(find.byIcon(Icons.wifi_off_rounded), findsNothing);
 
       // Go offline — update provider state, then let AnimatedSize animate.
       container.read(isOnlineProvider.notifier).state = false;
       await tester.pumpAndSettle();
-      expect(find.byIcon(Icons.wifi_off), findsOneWidget);
+      expect(find.byIcon(Icons.wifi_off_rounded), findsOneWidget);
     });
 
     testWidgets('child widget is always rendered regardless of connectivity',