Fix QA review findings: server-side validation, notes encoding, dashboard totals

Validate document lines on the server and recompute their totals, store notes with quotes/markup/emoji (utf8mb4, idempotent escaping, decode in form fields), exclude transfers from company-wide stock in/out, count revenue from confirmed orders only, one low-stock rule everywhere, list unapproved lots, natural bin sort, stable order/PO sort, status tiles that add up.

app/assets/js/custom.js

@@ -4,6 +4,36 @@ function escape_html(value) {
   });
 }
 
+// Text is stored HTML-escaped (see db_statement in dbconn.php), which is right
+// for anything written into markup but wrong inside a form field: a note saved
+// as  5" pipe <spare>  came back as  5&quot; pipe &lt;spare&gt;. Field values
+// are never parsed as HTML, so decoding them here is safe.
+function decode_html(value) {
+  if (typeof value !== 'string' || value.indexOf('&') === -1) return value;
+  return value.replace(/&(quot|#0*39|#x0*27|apos|lt|gt|amp);/gi, function (m, name) {
+    name = name.toLowerCase();
+    if (name === 'quot') return '"';
+    if (name === 'lt') return '<';
+    if (name === 'gt') return '>';
+    if (name === 'amp') return '&';
+    return "'";
+  });
+}
+
+(function ($) {
+  if (!$ || !$.fn || $.fn.val.__decodes_html) return;
+  var original_val = $.fn.val;
+  $.fn.val = function (value) {
+    if (arguments.length && typeof value === 'string') {
+      // Only free-text fields; a <select> value must keep matching its option.
+      var text_fields = this.filter('input, textarea');
+      if (text_fields.length === this.length) return original_val.call(this, decode_html(value));
+    }
+    return original_val.apply(this, arguments);
+  };
+  $.fn.val.__decodes_html = true;
+})(window.jQuery);
+
 /** =========================
  * SIDEBAR ACTIVE STATE
  * Override: activate the parent listing page for manage_* sub-pages.