refactor : simplify codebase and fix critical issues

Backend:
- Add MCP Serializer to centralize entity-to-array conversion (~300 lines deduped)
- Fix race condition in task/ticket number generation (SELECT FOR UPDATE + transaction)
- Add unique constraint on task (project_id, number) with migration
- Fix MIME type validation: use server-detected finfo instead of client-supplied type
- Add allowlist of permitted MIME types for uploads
- Fix TaskDocumentDownloadController: allow ROLE_CLIENT access, add priority:1
- Fix notification sent even when ticket status unchanged
- Remove redundant exception constructors
- Simplify services (BookStackApi double fetch, TokenEncryptor, GiteaApi)
- Consolidate duplicate checks in processors

Frontend:
- Fix useApi isHandlingUnauthorized scope (module-level to prevent double 401 redirect)
- Fix client-tickets toast key copy-paste bug
- Merge duplicated tasks service methods (getByProject + getByProjectArchived)
- Extract shared uploadWithRelation helper in task-documents service
- Extract formatFileSize utility from duplicated component code
- Extract status transition logic into useClientTicketHelpers composable
- Remove dead code (unused router, handleLogout, empty script blocks)
- Merge duplicate watchers and onMounted calls
- Normalize arrow functions to function declarations per convention

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/services/auth.ts

@@ -1,22 +1,22 @@
 import type { UserData } from './dto/user-data'
 
-export const getCurrentUser = () => {
-  const api = useApi()
-  return api.get<UserData>('/me', {}, { toastErrorKey: 'errors.auth.session' })
+export function getCurrentUser() {
+    const api = useApi()
+    return api.get<UserData>('/me', {}, { toastErrorKey: 'errors.auth.session' })
 }
 
-export const login = (username: string, password: string) => {
-  const api = useApi()
-  return api.post('/login_check', { username, password }, {
-    toastOn401: true,
-    toastErrorKey: 'errors.auth.login'
-  })
+export function login(username: string, password: string) {
+    const api = useApi()
+    return api.post('/login_check', { username, password }, {
+        toastOn401: true,
+        toastErrorKey: 'errors.auth.login'
+    })
 }
 
-export const logout = () => {
-  const api = useApi()
-  return api.post('/logout', {}, {
-    toastErrorKey: 'errors.auth.logout',
-    toastSuccessKey: 'success.auth.logout'
-  })
+export function logout() {
+    const api = useApi()
+    return api.post('/logout', {}, {
+        toastErrorKey: 'errors.auth.logout',
+        toastSuccessKey: 'success.auth.logout'
+    })
 }

frontend/services/client-tickets.ts

@@ -32,7 +32,7 @@ export function useClientTicketService() {
 
     async function update(id: number, data: Partial<ClientTicketWrite>): Promise<ClientTicket> {
         return api.patch<ClientTicket>(`/client_tickets/${id}`, data as Record<string, unknown>, {
-            toastSuccessKey: 'clientTicket.statusUpdated',
+            toastSuccessKey: 'clientTicket.updated',
         })
     }
 

frontend/services/task-documents.ts

@@ -15,30 +15,24 @@ export function useTaskDocumentService() {
         return extractHydraMembers(data)
     }
 
-    async function upload(taskId: number, file: File): Promise<TaskDocument> {
+    async function uploadWithRelation(relationField: string, relationIri: string, file: File): Promise<TaskDocument> {
         const formData = new FormData()
         formData.append('file', file)
-        formData.append('task', `/api/tasks/${taskId}`)
+        formData.append(relationField, relationIri)
 
-        return await $fetch<TaskDocument>(`${baseURL}/task_documents`, {
+        return $fetch<TaskDocument>(`${baseURL}/task_documents`, {
             method: 'POST',
             body: formData,
             credentials: 'include',
-            // Do NOT set Content-Type — browser sets multipart boundary automatically
         })
     }
 
-    async function uploadForTicket(clientTicketId: number, file: File): Promise<TaskDocument> {
-        const formData = new FormData()
-        formData.append('file', file)
-        formData.append('clientTicket', `/api/client_tickets/${clientTicketId}`)
+    async function upload(taskId: number, file: File): Promise<TaskDocument> {
+        return uploadWithRelation('task', `/api/tasks/${taskId}`, file)
+    }
 
-        return await $fetch<TaskDocument>(`${baseURL}/task_documents`, {
-            method: 'POST',
-            body: formData,
-            credentials: 'include',
-            // Do NOT set Content-Type — browser sets multipart boundary automatically
-        })
+    async function uploadForTicket(clientTicketId: number, file: File): Promise<TaskDocument> {
+        return uploadWithRelation('clientTicket', `/api/client_tickets/${clientTicketId}`, file)
     }
 
     async function getByTicket(clientTicketId: number): Promise<TaskDocument[]> {

frontend/services/tasks.ts

@@ -10,18 +10,10 @@ export function useTaskService() {
         return extractHydraMembers(data)
     }
 
-    async function getByProject(projectId: number): Promise<Task[]> {
+    async function getByProject(projectId: number, archived = false): Promise<Task[]> {
         const data = await api.get<HydraCollection<Task>>('/tasks', {
             project: `/api/projects/${projectId}`,
-            archived: false,
-        })
-        return extractHydraMembers(data)
-    }
-
-    async function getByProjectArchived(projectId: number): Promise<Task[]> {
-        const data = await api.get<HydraCollection<Task>>('/tasks', {
-            project: `/api/projects/${projectId}`,
-            archived: true,
+            archived,
         })
         return extractHydraMembers(data)
     }
@@ -49,5 +41,5 @@ export function useTaskService() {
         })
     }
 
-    return { getAll, getByProject, getByProjectArchived, getFiltered, create, update, remove }
+    return { getAll, getByProject, getFiltered, create, update, remove }
 }