refactor : simplify codebase and fix critical issues

Backend:
- Add MCP Serializer to centralize entity-to-array conversion (~300 lines deduped)
- Fix race condition in task/ticket number generation (SELECT FOR UPDATE + transaction)
- Add unique constraint on task (project_id, number) with migration
- Fix MIME type validation: use server-detected finfo instead of client-supplied type
- Add allowlist of permitted MIME types for uploads
- Fix TaskDocumentDownloadController: allow ROLE_CLIENT access, add priority:1
- Fix notification sent even when ticket status unchanged
- Remove redundant exception constructors
- Simplify services (BookStackApi double fetch, TokenEncryptor, GiteaApi)
- Consolidate duplicate checks in processors

Frontend:
- Fix useApi isHandlingUnauthorized scope (module-level to prevent double 401 redirect)
- Fix client-tickets toast key copy-paste bug
- Merge duplicated tasks service methods (getByProject + getByProjectArchived)
- Extract shared uploadWithRelation helper in task-documents service
- Extract formatFileSize utility from duplicated component code
- Extract status transition logic into useClientTicketHelpers composable
- Remove dead code (unused router, handleLogout, empty script blocks)
- Merge duplicate watchers and onMounted calls
- Normalize arrow functions to function declarations per convention

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/pages/login.vue

@@ -48,7 +48,6 @@ useHead({
     title: 'Connexion'
 })
 
-const router = useRouter()
 const auth = useAuthStore()
 const {version} = useAppVersion()
 
@@ -56,7 +55,7 @@ const username = ref('')
 const password = ref('')
 const isSubmitting = ref(false)
 
-const handleSubmit = async () => {
+async function handleSubmit() {
     if (isSubmitting.value) return
 
     isSubmitting.value = true
@@ -64,7 +63,7 @@ const handleSubmit = async () => {
         await auth.login(username.value, password.value)
 
         const isClient = auth.user?.roles?.includes('ROLE_CLIENT') ?? false
-        await router.push(isClient ? '/portal' : '/')
+        await navigateTo(isClient ? '/portal' : '/')
     } finally {
         isSubmitting.value = false
     }

frontend/pages/time-tracking.vue

@@ -284,24 +284,10 @@ async function onPaste() {
     await loadEntries()
 }
 
-onMounted(() => {
-    updatePageHeaderHeight()
-
-    if (!pageHeaderEl.value || typeof ResizeObserver === 'undefined') {
-        return
-    }
-
-    pageHeaderResizeObserver = new ResizeObserver(() => {
-        updatePageHeaderHeight()
-    })
-    pageHeaderResizeObserver.observe(pageHeaderEl.value)
-})
-
 onBeforeUnmount(() => {
     pageHeaderResizeObserver?.disconnect()
 })
 
-
 async function onDelete(entry: TimeEntry) {
     await timeEntryService.remove(entry.id)
     await loadEntries()
@@ -333,6 +319,15 @@ async function loadReferenceData() {
 }
 
 onMounted(async () => {
+    updatePageHeaderHeight()
+
+    if (pageHeaderEl.value && typeof ResizeObserver !== 'undefined') {
+        pageHeaderResizeObserver = new ResizeObserver(() => {
+            updatePageHeaderHeight()
+        })
+        pageHeaderResizeObserver.observe(pageHeaderEl.value)
+    }
+
     await loadReferenceData()
     await loadEntries()
 })